Operation Cold Key

LOCKOUT · WINDOWS · difficulty 5 · ~45 min · 20 steps

No malware. A Group Policy Object turned on BitLocker across the estate with somebody else's recovery key.

Briefing

05:50. Four hundred and eleven workstations are sitting at a blue screen asking for a BitLocker recovery key. Nobody deployed anything. There is no encryptor to find, no ransom note on disk, and your endpoint agent has not raised a single alert — because nothing malicious ever ran. A Group Policy Object was modified at 22:40 last night. It enables full-volume encryption, supplies a recovery password the attacker generated, and turns off escrow to Active Directory. Every machine that has rebooted since is theirs. The rest are still running and still encrypting. That is your window.

Objectives

• Find the policy, when it changed, and under whose account
• Establish which machines encrypted under the old policy and which under theirs
• Recover the escrowed keys for everything you still can
• Stop the rollout on machines that have not yet rebooted
• Unlock, then decide what has to be rebuilt

Return to the range lobby