A new extortion cocktail: office printers, small ransoms, and BitLocker

We cover two recent cases of BitLocker extortion using RDP, MSSQL, RMM tools, web shells, and printers. The story includes TTPs and recommendations. For defenders, the ransomware lifecycle — initial access, lateral movement, exfiltration, and encryption — offers multiple points where early intervention can prevent a full-scale incident. Security teams should review their detection rules, keep threat-intelligence feeds current, and validate that incident-response runbooks are tested before an incident occurs.