GhostLock is a useful reminder that availability attacks do not always need encryption, deletion, or ransomware-style payloads. By abusing legitimate Windows file-sharing behavior through the CreateFileW() API with exclusive access, a process can keep files locked and prevent users or applications from opening them, including files stored on SMB shares. The result is disruption without obvious file modification, which makes it harder for traditional anti-malware controls to classify as malicious.

Organizations should treat this as a file-server and endpoint monitoring problem, not just a malware problem. Unusual patterns of exclusive file opens, repeated STATUS_SHARING_VIOLATION errors, one process holding many file handles, or mass access attempts across SMB shares should be investigated quickly. Least-privilege access, SMB auditing, file-handle monitoring, endpoint visibility, and recovery procedures are important here, because apparently attackers have discovered they do not always need to steal or encrypt data when they can simply make everyone unable to use it.

A security researcher has released a proof-of-concept tool named GhostLock that demonstrates how a legitimate Windows file API can be abused in attacks to block access to files stored locally or on SMB network shares. [...]

Source: New GhostLock tool abuses Windows API to block file access via Bleeping Computer — published 11 May 2026.