Executive Summary
GhostLock is an offensive research tool and technique disclosed by Kim Dvash that demonstrates how a low-privileged domain user can paralyze enterprise file shares (SMB/NAS) without triggering traditional ransomware defenses. Unlike typical ransomware, it does not encrypt, rename, or write any data to disk. Instead, it systematically calls the `CreateFileW` API with a 'deny-share' mode to lock hundreds of thousands of files, rendering them inaccessible to all other users and applications.
Technical analysis shows the tool uses a 32-thread parallel scanner to achieve rapid file discovery, capable of mapping 500,000 files in roughly 6 minutes. Because the attack relies on documented, correct Windows behavior rather than a software defect, there is no CVE or patch available. Standard security controls like EDR, NDR, and canary files currently fail to detect this activity as it lacks the 'write' signals and high-entropy indicators typical of encryption events.
This technique represents a significant risk to business continuity. The impact mirrors a ransomware infection—crashing ERP systems and halting workflows—but recovery is complicated by the need for storage-layer intervention. Security teams must integrate NAS-level session telemetry into their SIEM pipelines to identify anomalous accumulations of exclusive handles.