Interlock RAT
Interlock RAT is a stealthy, modular remote access trojan/backdoor first observed in mid-to-late 2024 and primarily associated with the Interlock ransomware ecosystem. Reporting describes it as a lightweight binary with encrypted command-and-control communications and a plugin-based architecture that allows operators to add capabilities after compromise. Its documented functions include unauthorized remote control, system reconnaissance, data exfiltration, collection of system details, network mapping, and enabling lateral movement via RDP. Related reporting also describes a broader Interlock/NodeSnake framework with implementations in PowerShell, PHP, C/C++, Java, and JavaScript for Windows and Linux, capable of fetching commands to launch a SOCKS5 proxy tunnel, spawn a reverse shell, and deliver additional payloads including Interlock ransomware and Slopoly.
Observed delivery vectors include phishing, being dropped by other malware, fake browser update chains from compromised legitimate websites impersonating Google Chrome or Microsoft Edge installers, and ClickFix/FileFix-style social engineering. In one reported KongTuke-linked campaign, compromised websites displayed fake CAPTCHA prompts that instructed users to paste attacker-provided text into the Windows Run dialog; the resulting PowerShell installed a PHP variant of Interlock RAT. That variant reportedly used Cloudflare Tunnel URLs for stealthy C2, stored itself as php.exe under AppData for persistence, collected system information, mapped networks, and supported lateral movement via RDP. Public reporting also ties Interlock RAT distribution to the KongTuke/TAG-124 traffic distribution system, which has delivered Interlock RAT variants as downstream payloads.
Interlock RAT is closely associated with the Interlock ransomware group and with activity tracked by IBM X-Force as Hive0163. Content also notes overlap in reporting that groups Interlock RAT with NodeSnake, and states NodeSnake is designed to run shell commands, establish persistence, and retrieve and launch Interlock RAT. High-confidence behavioral references in the provided content include persistence establishment, outbound C2 communications, PowerShell-based staging, fake CAPTCHA/FileFix infection chains, Cloudflare Tunnel-based C2 in at least one PHP variant, storage as php.exe in AppData, and use in intrusion chains that ultimately lead to ransomware deployment.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The framework has multiple implementations in PowerShell, PHP, C/C++, Java, and JavaScript to support both Windows and Linux. Like NodeSnake, it also communicates with a remote server to fetch commands that allow it to launch a SOCKS5 proxy tunnel, spawn a reverse shell on the infected machine, and deliver more payloads, such as Interlock ransomware and Slopoly.
...used a technique called FileFix to spread a PHP variant of Interlock RAT...
Techniques & procedures
12 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
2 techniques
Initial Access
Execution
4 techniques
Execution
Like NodeSnake, it also communicates with a remote server to fetch commands that allow it to launch a SOCKS5 proxy tunnel, spawn a reverse shell on the infected machine, and deliver more payloads.
Discovery
1 technique
Discovery
Command and Control
4 techniques
Command and Control
C2 Servers (payload delivery)... port 3456 is consistent across the fleet... Additional C2s... TLSv1.0 encrypted C2... TCP backdoor.
IOCs tracked for this family
49 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
Other indicator types observed in public reporting.
Recent activity
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Associated Analytic Story Azorult Crypto Stealer Forest Blizzard IcedID Interlock Rat Quasar RAT
Cross-platform remote access trojan/framework that communicates with a remote server to fetch commands, launch a SOCKS5 proxy tunnel, spawn a reverse shell, and deliver additional payloads including Interlock ransomware and Slopoly.
A RAT variant delivered as a final payload in KongTuke campaigns and linked in reporting to Interlock activity.
Associated Analytic Story Azorult Crypto Stealer Forest Blizzard IcedID Interlock Rat Quasar RAT
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.