{"id":236943,"date":"2026-05-12T02:31:53","date_gmt":"2026-05-12T07:31:53","guid":{"rendered":"https:\/\/lifeboat.com\/blog\/2026\/05\/new-ghostlock-tool-abuses-windows-api-to-block-file-access"},"modified":"2026-05-12T02:31:53","modified_gmt":"2026-05-12T07:31:53","slug":"new-ghostlock-tool-abuses-windows-api-to-block-file-access","status":"publish","type":"post","link":"https:\/\/lifeboat.com\/blog\/2026\/05\/new-ghostlock-tool-abuses-windows-api-to-block-file-access","title":{"rendered":"New GhostLock tool abuses Windows API to block file access"},"content":{"rendered":"<p><a class=\"aligncenter blog-photo\" href=\"https:\/\/lifeboat.com\/blog.images\/new-ghostlock-tool-abuses-windows-api-to-block-file-access.jpg\"><\/a><\/p>\n<p>A security researcher has released a proof-of-concept tool named GhostLock that demonstrates how a legitimate Windows file API can be abused in attacks to block access to files stored locally or on SMB network shares.<\/p>\n<p>This technique, created by Kim Dvash of Israel Aerospace Industries, abuses the Windows \u2018<a href=\"https:\/\/learn.microsoft.com\/en-us\/windows\/win32\/api\/fileapi\/nf-fileapi-createfilew\" target=\"_blank\" rel=\"nofollow noopener\">CreateFileW<\/a>\u2019 API and file-sharing modes to prevent other users and applications from opening files while handles remain active.<\/p>\n<p>The <a href=\"https:\/\/ghostlock.io\/\" target=\"_blank\" rel=\"nofollow noopener\">GhostLock technique<\/a> abuses the \u2018dwShareMode\u2019 parameter in the CreateFileW function, which specifies the type of access other processes have to a file while it is opened.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>A security researcher has released a proof-of-concept tool named GhostLock that demonstrates how a legitimate Windows file API can be abused in attacks to block access to files stored locally or on SMB network shares. This technique, created by Kim Dvash of Israel Aerospace Industries, abuses the Windows \u2018CreateFileW\u2019 API and file-sharing modes to prevent [\u2026]<\/p>\n","protected":false},"author":427,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1492],"tags":[],"class_list":["post-236943","post","type-post","status-publish","format-standard","hentry","category-security"],"_links":{"self":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/236943","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/users\/427"}],"replies":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/comments?post=236943"}],"version-history":[{"count":0,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/236943\/revisions"}],"wp:attachment":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/media?parent=236943"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/categories?post=236943"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/tags?post=236943"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}