GhostLock Turns Windows File Sharing Into a Denial-of-Access Trap
A newly disclosed technique highlights how exclusive file opens and SMB locking behavior can disrupt shared folders without encrypting the data itself.
Introduction
Enterprise defenders are trained to look for encryption, corruption, and exfiltration. GhostLock points to a different problem: an attacker may be able to abuse ordinary Windows file-open behavior to create a lockout event on SMB shares, leaving business files unavailable even when their contents remain untouched.
At the time of writing, public information does not fully establish the complete technical path, the real-world prevalence of the technique, or the full operational scope of affected environments.
Fast Facts
- GhostLock is described as a newly disclosed technique aimed at Windows SMB file shares.
- The core behavior appears to rely on exclusive file opens rather than file encryption.
- Windows CreateFileW can request exclusive access when share mode is set to zero.
- SMB and SMB2 enforce share and lock rules that can block competing access.
- Detection may need to focus on lock activity, session anomalies, and unusual open patterns.
Body
The technical interest here is not damage to data on disk, but contention over access. On Windows, CreateFileW is the standard file-open API, and its sharing flags matter. If a process asks for exclusive access, other opens that conflict with that request can fail with a sharing violation until the handle is closed.
That matters on SMB shares because the protocol is built to enforce access rules across the network. SMB2 also supports byte-range locking, which can prevent other reads, writes, or locks on protected regions. In practical terms, a large number of exclusive opens or lock requests can create an availability problem without changing a single byte of file content.
From a defensive perspective, this is important because many security controls are tuned to spot encryption behavior, mass file rewrites, or obvious destructive activity. An availability-only lockout attack may leave a different telemetry trail: bursts of file-open attempts, a spike in exclusive access, and sharing violations reported by legitimate users.
The broader risk is that one account with valid share access could cause outsized disruption if it can touch many files quickly and hold those handles open. That does not prove GhostLock is easy to reproduce or broadly deployed, but it does show why file-server monitoring has to include handle and lock behavior, not just data-modification events.
For defenders, the practical lesson is straightforward: watch SMBClient and SMBServer logs, restrict broad share permissions, keep SMB signing and encryption enabled, and plan for forced session termination when a file server becomes stuck behind suspicious handles. Availability attacks often look quiet until users start hitting “access denied” or “sharing violation” errors at scale.
Conclusion
GhostLock is a reminder that a locked file can be as disruptive as an encrypted one. The lesson for security teams is not to assume that ransomware-style impact always requires file corruption. In Windows environments, the rules of access themselves can become the weapon, and that makes SMB telemetry a frontline defense rather than an afterthought.
TECHCROOK
external backup drive: Keeping an offline copy of critical files is a practical recovery step when shared folders become unavailable or a server is stuck behind suspicious locks. A USB external drive is simple, widely available, and useful for scheduled local backups or quick restores. Look for enough capacity for full-file copies, hardware encryption if needed, and a rugged enclosure for office use.
WIKICROOK
- CreateFileW: A Windows API used to open files or devices with defined access and sharing settings.
- dwShareMode: A CreateFileW parameter that controls whether other processes can share the open file.
- SMB: A network file-sharing protocol used by Windows systems to access files over a network.
- Sharing violation: An error that occurs when another open conflicts with the file’s current sharing rules.
- Byte-range lock: A lock on part of a file that can block other read, write, or lock operations.
