1.0 Introduction
The Interlock ransomware variant was first observed in late September 2024, targeting various businesses and critical infrastructure across organisations in North America and Europe. According to a joint advisory released by the FBI, CISA, HHS, and MS-ISAC, these actors target their victims based on opportunity, and their activity is financially motivated. Interlock actors have been observed using uncommon initial access methods, via drive-by downloads from compromised legitimate websites and the ClickFix social engineering technique, which tricks users into executing malicious payloads disguised as system fixes. The ransomware is capable of encrypting virtual machines (VMs) on both Windows and Linux platforms, with the threat actors employing a variety of tactics for discovery, credential access, and lateral movement within networks.
2.0 Impact
Interlock ransomware can cause severe disruption by encrypting critical systems and exfiltrating sensitive data. It targets virtualised environments across Windows, Linux, and FreeBSD platforms. Victims risk operational downtime, financial losses, and reputational damage, especially if stolen data is publicly leaked. The absence of an initial ransom demand adds uncertainty, while the threat actors often follow through on threats to expose data if payments are not made.
3.0 Targets
Interlock ransomware primarily targets organisations across various North America and Europe sectors, focusing on entities that rely on virtualised environments. Affected industries include business enterprises, healthcare, education, and critical infrastructure. The actors conduct opportunistic attacks, exploiting exposed or vulnerable systems regardless of organisation size, and show particular interest in environments running Windows, Linux, and FreeBSD operating systems.
4.0 Technical Details
4.1 Initial Access
Interlock actors typically gain initial access through drive-by downloads hosted on compromised websites. Malicious payloads are often disguised as fake browser or software updates, such as Google Chrome, Microsoft Edge, or security software like FortiClient or Cisco AnyConnect. In some cases, the group has used the ClickFix technique, where users are deceived into running a fake CAPTCHA that executes Base64-encoded PowerShell commands, launching the attack without the user realising.
4.2 Execution And Persistence
Once inside the system, Interlock actors use a fake executable that functions as a remote access trojan (RAT) to execute PowerShell scripts that place malicious files in the Windows Startup folder, allowing persistence on user login. They also modify Windows Registry run keys using PowerShell to ensure the malware continues running across reboots. These actions are disguised under legitimate-sounding names like “Chrome Updater” to evade detection.
4.3 Reconnaissance
To gather intelligence on the infected system, Interlock actors use PowerShell scripts to execute system discovery commands. These include checking the current user identity, system configuration, active services, logical drives, and ARP cache entries. This information helps the attackers map the environment and plan further actions such as lateral movement or privilege escalation.
4.4 Command and Control (C2)
For command and control operations, Interlock actors rely on tools such as Cobalt Strike and SystemBC, along with their own Interlock RAT and NodeSnake RAT. These tools allow attackers to maintain remote access, issue commands, and coordinate post-compromise activity across the network.
4.5 Credential Access, Lateral Movement and Privilege Escalation
After establishing remote access, Interlock actors deploy credential-stealing tools like cht.exe and keyloggers like klg.dll, which record keystrokes into files named conhost.txt. They also use other information stealers such as Lumma and Berserk Stealer to collect credentials. The attackers move laterally using stolen credentials via Remote Desktop Protocol (RDP) or remote access tools like AnyDesk and PuTTY. In some cases, they have gained elevated privileges by compromising domain administrator accounts, possibly using Kerberoasting attacks.
4.6 Collection and Exfiltration
Before encryption, Interlock actors collect and exfiltrate data using tools like Azure Storage Explorer and AzCopy, uploading stolen data to cloud storage accounts. They also use file transfer applications such as WinSCP to exfiltrate data over FTP or SCP protocols. This exfiltrated data is then used as leverage in double extortion schemes.
5.0 Indicator of Compromise (IoCs)
Table 1: File-Based (SHA-256)
| File Name | SHA-256 Hash |
|---|---|
| 1.ps1 | fba4883bf4f73aa48a957d894051d78e0085ecc3170b1ff50e61ccec6aeee2cd |
| AnyDesk.exe | 1a70f4eef11fbecb721b9bab1c9ff43a8c4cd7b2cafef08c033c77070c6fe069 |
| cht.exe | c20baba26ebb596de14b403b9f78ddc3c13ce9870eea332476ac2c1dd582aa07 |
| klg.dll | a4f0b68052e8da9a80b70407a92400c6a5def19717e0240ac608612476e1137e |
| conhost | 44887125aa2df864226421ee694d51e5535d8c6f70e327e9bcb366e43fd892c1 |
| StorageExplorer.exe | 73a9a1e38ff40908bcc15df2954246883dadfb991f3c74f6c514b4cffdabde66 |
| putty.exe | 7a43789216ce242524e321d2222fa50820a532e29175e0a2e685459a19e09069 |
| PsExec.exe | 078163d5c16f64caa5a14784323fd51451b8c831c73396b967b4e35e6879937b |
| WinSCP-6.3.5-Setup.exe | 8eb7e3e8f3ee31d382359a8a232c984bdaa130584cad11683749026e5df1fdc3 |
| Encryptor | e86bb8361c436be94b0901e5b39db9b6666134f23cce1e5581421c2981405cb1 |
| Encryptor | c733d85f445004c9d6918f7c09a1e0d38a8f3b37ad825cd544b865dba36a1ba6 |
| Encryptor | 28c3c50d115d2b8ffc7ba0a8de9572fbe307907aaae3a486aabd8c0266e9426f |
| tmp41.wasd (DLL) | Used post-encryption, deleted using remove() function |
Table 2: File-Based IOCs (SHA-1)
| File Name | SHA-1 Hash |
|---|---|
| autorun.log | 514946a8fc248de1ccf0dbeee2108a3b4d75b5f6 |
| jar.jar | b625cc9e4024d09084e80a4a42ab7ccaa6afb61d |
| pack.jar | 3703374c9622f74edc9c8e3a47a5d53007f7721e |
Table 3: Tools Used by Interlock Actors
| Tool Name | Description |
|---|---|
| AnyDesk | Remote access tool used for persistence and lateral movement |
| Cobalt Strike | Pen-testing tool used for C2 |
| PuTTY | SSH tool used for lateral movement and remote sessions |
| SystemBC | Proxy and backdoor tool |
| NodeSnake RAT | Custom RAT used for C2 and persistence |
| Interlock RAT | Custom RAT used by threat actors |
| PowerShell | Used for script execution, reconnaissance, persistence |
| AzCopy | Used to exfiltrate data to Azure blob storage |
| StorageExplorer.exe | Used to browse Azure storage accounts |
| WinSCP | File transfer tool used for data exfiltration |
| ScreenConnect | Used in cracked form for remote access |
| PSExec | Executes commands and payloads on remote systems |
6.0 MITRE ATT&CK Tactics and Techniques
| Tactic | Technique | ID | Usage |
|---|---|---|---|
|
Initial Access |
Drive-by Compromise | T1189 | Compromised websites deliver disguised malware (e.g., fake browser/security updates). |
| User Execution: Malicious Copy and Paste (ClickFix) | T1204.004 | Fake CAPTCHA prompts user to execute Base64-encoded PowerShell commands. | |
|
Execution |
Command and Scripting Interpreter: PowerShell | T1059.001 | Executes scripts for installation, reconnaissance, and persistence. |
|
Persistence |
Registry Run Keys / Startup Folder | T1547.001 | Adds files to Startup folder and modifies registry for persistence. |
|
Privilege Escalation |
Valid Accounts: Domain Accounts | T1078.002 | Uses compromised domain admin accounts for elevated privileges. |
|
Defense Evasion |
Masquerading: Match Legitimate Resource Name or Location | T1036.005 | Disguises files as legitimate system files like conhost.exe, conhost.txt. |
| System Binary Proxy Execution: Rundll32 | T1218.011 | Executes malicious DLL (tmp41.wasd) via rundll32.exe. | |
| Indicator Removal: File Deletion | T1070.004 | Deletes encryption binaries after execution (removeme function). | |
|
Credential Access |
Input Capture: Keylogging | T1056.001 | Uses klg.dll to log keystrokes in conhost.txt. |
| Credentials from Web Browsers | T1555.003 | Steals browser-stored credentials. | |
| Steal or Forge Kerberos Tickets: Kerberoasting | T1558.003 | Potentially used to compromise domain admin accounts. | |
|
Discovery |
System Owner/User Discovery | T1033 | PowerShell retrieves current user identity. |
| System Information Discovery | T1082 | Retrieves OS, drive, and hardware info via systeminfo, Get-PSDrive. | |
| System Service Discovery | T1007 | Identifies running services via Get-Service, tasklist /svc. | |
| System Network Configuration Discovery | T1016 | Uses arp -a to get network configuration and ARP cache data. | |
|
Lateral Movement |
Remote Services: Remote Desktop Protocol (RDP) | T1021.001 | Uses RDP with stolen credentials to spread. |
| Valid Accounts | T1078 | Harvested credentials reused for lateral movement. | |
|
Collection |
Data from Cloud Storage | T1530 | Uses StorageExplorer.exe to access Microsoft Azure Storage. |
|
Command and Control |
Ingress Tool Transfer | T1105 | Transfers RATs and stealers like cht.exe, klg.dll. |
| Remote Access Tools | T1219 | Uses AnyDesk, PuTTY for remote control and lateral movement. | |
| Command and Control (General) | TA0011 | Uses Cobalt Strike, SystemBC, NodeSnake RAT, Interlock RAT. | |
|
Exfiltration |
Exfiltration to Cloud Storage | T1567.002 | Uses AzCopy to upload stolen data to Azure blob storage. |
| Exfiltration Over Alternative Protocol | T1048 | Uses tools like WinSCP to transfer stolen data externally. | |
|
Impact |
Data Encrypted for Impact | T1486 | Encrypts data using AES+RSA on Windows/Linux/FreeBSD. |
| Financial Theft / Extortion via Ransom Note | T1657 | Ransom note issued with Tor contact and threat to leak stolen data. |
7.0 Recommendation
CyberSecurity Malaysia advises that system administrators implement the following mitigations to strengthen defenses against Interlock ransomware and similar threats. These recommendations are aligned with global best practices and the Cross-Sector Cybersecurity Performance Goals (CPGs) developed by CISA and NIST.
For more information, please refer to the official advisory:
7.1 Recommendations for System Administrators
- Implement Domain Name System (DNS) filtering to block access to malicious websites.
- Deploy web access firewalls to prevent command injection and unauthorized access.
- Train users to recognize and report phishing and social engineering attempts.
- Disable hyperlinks in emails and add banners to emails received from external sources.
- Develop and maintain a recovery plan with encrypted, offline, and immutable backups stored separately from production systems.
- Enforce strong password policies in compliance with NIST standards; use long passwords and avoid frequent forced resets.
- Require multi-factor authentication (MFA) for access to email, VPNs, and critical systems.
- Apply identity, credential, and access management (ICAM) policies organization-wide.
- Use time-based access controls (e.g., Just-in-Time access) for privileged accounts.
- Ensure all operating systems, applications, and firmware are regularly updated and patched.
- Prioritize patching known exploited vulnerabilities in internet-facing services.
- Deploy endpoint detection and response (EDR) tools across virtual machines, endpoints, and servers.
- Monitor network activity with tools capable of detecting abnormal and lateral movement behavior.
- Filter inbound network traffic to block access from untrusted or unknown sources.
- Install, enable, and regularly update antivirus and anti-malware software with real-time protection.
- Segment networks to contain the spread of malware and restrict lateral movement.
- Disable unused ports and unnecessary services on all systems.
- Regularly review and audit user accounts, especially those with administrative privileges.
- Apply the principle of least privilege to all user and system accounts.
- Restrict or turn off command-line and scripting capabilities (e.g., PowerShell, CMD) where not needed.
- Maintain frequent backups and regularly test restoration procedures.
- Ensure all backups are encrypted, immutable, and cover the entire data infrastructure.
For further enquiries or incident reporting, please get in touch with Cyber999 through the following channels:
8.0 References
- https://www.cisa.gov/news-events/alerts/2025/07/22/joint-advisory-issued-protecting-against-interlock-ransomware
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-203a?utm_source=Interlock&utm_medium=GovDelivery
- https://www.cisa.gov/sites/default/files/2025-07/aa25-203a-stopransomware-interlock-072225.pdf
- https://www.cisa.gov/sites/default/files/2025-07/AA25-203A-interlock-stix.xml
- https://www.cisa.gov/sites/default/files/2025-07/AA25-203A-interlock-stix.json
- https://www.cisa.gov/stopransomware