Loading threat actor…
Interlock is a financially motivated ransomware and data-extortion group first observed in September 2024. Also known as Interlock ransomware or the Interlock ransomware gang, it conducts double-extortion attacks that combine theft of sensitive information with system encryption and threats of publication on a dedicated leak site. Its targets include healthcare providers, educational institutions, government organizations, manufacturers, contractors, and defense-sector organizations, with a predominantly United States focus. Attacks against DaVita and Kettering Health caused significant healthcare operational disruption. No nation-state sponsorship or country of origin has been established. Interlock obtains initial access through compromised websites, counterfeit browser and VPN updates, trojanized installers, and ClickFix social engineering that induces users to execute malicious commands. An intrusion exploiting CVE-2026-20131 demonstrates its use of network-edge vulnerabilities for initial access. Its infection chains have been linked to the TAG-124 traffic distribution system, although an organizational relationship between the operators has not been established. The group uses credential stealers, keyloggers, PowerShell backdoors, and custom remote-access malware, including Interlock RAT and NodeSnake. A Node.js-based Interlock RAT variant executes malicious JavaScript through a legitimate signed runtime, supports SOCKS proxying, fingerprints compromised hosts, and enumerates Active Directory users, privileged groups, domain trusts, and potential backup servers. Persistence mechanisms include scheduled tasks, startup shortcuts, and user-level autorun entries. Obfuscation, living-off-the-land techniques, and abuse of legitimate software help conceal malicious activity. Interlock uses remote-access and administrative tools for continued access and lateral movement, and cloud-storage utilities for data exfiltration. Its ransomware targets Windows and Unix-like environments, including virtualized infrastructure. Operations have included weekend encryption deployments intended to take advantage of reduced staffing. Stolen medical, employee, financial, and proprietary business information provides additional leverage for ransom demands.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
49 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
11 malware families attributed to this actor across reporting.
6 additional families tracked in Mallory.
4 CVEs this actor has used in observed campaigns. 4 of them exploited in the wild.
Lastly, in a March 2026 report, Amazon threat intelligence documented an Interlock intrusion exploiting CVE-2026-20131, demonstrating the group’s ability to exploit network edge devices to achieve initial access.
Hotta Killer (Interlock): exploits a gaming anti-cheat driver zero-day (CVE-2025-61155) to attack FortiEDR
Local privilege escalation exploit CVE-2023-36036 (JunkFiction-crypted) ... CVE CVE-2023-36036 Local privilege escalation exploit used by Interlock and ModeloRAT operators
The reported May 2025 AMTEC/National Defense Corporation attack included "Exploitation of unpatched CVE-2024-21407 (Windows Kernel privilege escalation flaw)."
112 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Reportedly conducted a ransomware attack against pharmaceutical wholesaler Nu-Quest Distribution Inc., discovered on October 12, 2026. The report includes claims that confidential pricing, drug transaction and compliance records, financial statements, employee files, and legal documents were leaked after the company declined to negotiate. The victim's location is inconsistent: the report labels it US-based but also places it in Newfoundland and Labrador, Canada.
Reportedly conducted a ransomware attack against US-based Engineers Contractors Fabricators Inc., a piping and insulation contractor serving hydrocarbon terminals. The report attributes claims of access to confidential engineering designs, customer information, financial records, employee information, and trade secrets to the group. The reported discovery date is October 12, 2026; the content does not independently verify the attack or data exposure.
Reportedly conducted a ransomware attack against US-based Greentech Environmental. The incident was reported as discovered on October 12, 2026, at 15:48 UTC. The accompanying attacker statement claims publication of confidential information, including intellectual property, financial statements, employee data, strategic plans, legal documents, and manufacturing drawings. These claims are not independently verified in the supplied content.
Reportedly conducted a ransomware attack against Concord Eye Center, a US ophthalmology clinic. The report describes a breach involving sensitive patient identification, medical, insurance, and billing records, discovered on October 12, 2026. The content does not independently substantiate the allegations about the clinic’s security practices or the extent of data exposure.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.