Windows CreateFileW API Flaw Could Let Attackers Lock SMB Files at Scale

The multi-billion-dollar ransomware defence industry operates on a fundamental assumption: to cause catastrophic operational damage, malicious actors must write corrupted data to a disk.

However, a newly disclosed attack technique, GhostLock, completely invalidates this foundational premise by demonstrating how threat actors can paralyze enterprise file systems without encrypting a single byte.

Published in May 2026 by security researcher Kim Dvash, the open-source proof-of-concept reveals how a standard, low-privileged domain user account, typically acquired through routine phishing campaigns, can lock hundreds of thousands of files on an enterprise network attached storage system.

By executing this attack, threat actors can instantly trigger extensive sharing violations across crucial enterprise resource planning systems and shared business workflows, leaving absolutely no traditional forensic signature behind.

The Mechanics of an Encryptionless Attack

The core mechanism driving the GhostLock intrusion is not an obscure zero-day vulnerability, but rather the clever exploitation of a fully documented Windows operating system function, the CreateFileW API.

When a network client calls this specific application programming interface and explicitly sets the sharing mode parameter to 0, the system’s input and output manager grants an exclusive deny-share handle.

Under the Server Message Block protocol specification, the receiving server must strictly enforce this share contract, effectively ensuring that no other process or user can read, write, or delete the target file until the malicious actor voluntarily closes the handle.

At the kernel level, the file system driver enforces these strict sharing semantics entirely in memory, offering no possible user-mode bypass. The GhostLock tool leverages this standard behavior at enterprise scale with a highly optimized, multithreaded parallel discovery architecture.

By scanning directories and requesting these read-only exclusive handles simultaneously, the automated script can successfully locate and lock half a million files on a corporate network share in less than three minutes.

Because this technique fundamentally alters the traditional anatomy of a network lockout attack, it successfully bypasses almost every layer of a modern cybersecurity defense architecture.

Security honeypots and canary files are rendered entirely useless because the attack generates exactly zero write, rename, or delete events on the compromised storage volume, as reported by Andrea Fortuna.

Behavioral artificial intelligence models and sophisticated write-rate anomaly detectors similarly fail to trigger alerts because the network traffic profile is indistinguishable from a benign enterprise search indexer or a routine backup application opening documents in rapid succession.

At the endpoint detection and response level, the system calls appear identical to a standard employee rapidly opening office documents, producing no recognizable shellcode injections or memory anomalies.

Furthermore, data loss prevention tools remain completely silent when the attacker opens the files without actively exfiltrating their contents, keeping network traffic well below established alerting thresholds.

Strategic Detection and Incident Recovery

Because restricting the underlying API would catastrophically break legitimate software operations, security operations centers must pivot strictly to specialized telemetry-based detection strategies.

The single reliable indicator of a GhostLock attack resides within the storage management session table, which actively tracks the number of simultaneous exclusive handles held by each user.

Security teams should ingest this specific storage telemetry directly into their centralized logging platforms and configure critical alerts for any single session that exceeds 500 exclusive handles.

From an incident response perspective, standard forensic investigations will show no modified timestamps or new files, often leading analysts down the wrong path.

Most importantly, simply revoking the compromised Active Directory credentials is insufficient, as the pre-authenticated network session will aggressively maintain its file locks until the connection naturally times out.

To contain the threat, update the incident response runbooks immediately to require direct coordination with storage administrators to forcefully terminate the offending network session at the storage infrastructure layer.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.