A new ransomware strain is implementing a troubling but so far relatively rarely used technique to encrypt data in a target environment.

Instead of encrypting files on endpoint systems like most ransomware families, the new malware, dubbed “DeepBlueMagic,” targets different disk drives on a target organization’s servers, researchers from Heimdal Security say.

The malware was observed using a legitimate third-party encryption tool called BestCrypt Volume Encryption from Jetico to start encryption on all drives — except the primary system drive (“C:”) — on an infected Windows Server 2012 R2 system.

Heimdal found the encryption tool, along with a rescue file (rescue.rsc) that Jetico’s software typically uses to recover damaged partitions, on the system drive of the infected machine. In this instance, however, the rescue file was encrypted as well and required a password to open it, according to Heimdal’s new report.

The security vendor was not able to determine how attackers might have gained initial access to the compromised system, nor was it able to obtain a sample of the original executable file because the ransomware deleted itself from the system.

Heimdal’s investigation showed that DeepBlueMagic had started the encryption process on the infected system’s D: drive and almost immediately stopped the process after initiation. This resulted in the drive being partially encrypted and turned into a RAW partition — that is, basically, a partition where the file system structure has been corrupted and therefore not recognized by the system.

“Any access attempt would have the Windows OS interface prompt the user to accept formatting the disk since the drive looks broken once encrypted,” Heimdal says in its report. Usually, the rescue file that Jetico’s encryption software uses could have been used to restore the partially encrypted drive, but in this case that was not possible because the rescue file had been encrypted as well.

As is the case with many ransomware strains these days, DeepBlueMagic is designed to disable any behavior-based threat detection tools that might be present on a targeted server — before the…