Loading malware…
Interlock is a ransomware family operated by the eponymous cybercriminal group, tracked by Sophos as GOLD EMBRACE and active since September 2024. It targets Windows, Linux, and VMware ESXi environments. The operation combines file and virtual-machine disk encryption with data theft, demanding payment and threatening publication of stolen information. Victims include healthcare providers, educational institutions, government bodies, manufacturers, and other critical-infrastructure organizations, particularly in North America and Europe.
Interlock intrusion chains use compromised legitimate websites, counterfeit software updates, and ClickFix social engineering. Fake CAPTCHA prompts persuade users to paste malicious commands into the Windows Run dialog or PowerShell, initiating staged downloads and remote-access payload execution. The operators have also exploited CVE-2026-20131 in Cisco Secure Firewall Management Center for initial access, including exploitation before public disclosure in March 2026.
The ransomware is deployed after broader network compromise. Associated tooling includes NodeSnake, InterlockRAT, Supper, custom JavaScript and Java remote-access trojans, and legitimate remote-administration software. Observed operations involve host and Active Directory reconnaissance, scheduled-task persistence, credential dumping, Kerberoasting, lateral movement, security-software tampering, and data exfiltration before encryption. Operators have abused WinPmem and Volatility3 to obtain password hashes and cached domain credentials from memory, and have used cloud-storage utilities to transfer stolen data. These credential-theft and remote-access functions belong to the wider intrusion toolkit rather than necessarily to the ransomware encryptor itself.
Interlock attacks have caused substantial operational disruption, including interruptions to healthcare services. The operation uses publication of stolen employee, patient, and organizational data as additional leverage alongside the loss of access to encrypted systems.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
5 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The reported May 2025 AMTEC/National Defense Corporation attack included "Exploitation of unpatched CVE-2024-21407 (Windows Kernel privilege escalation flaw)."
Lastly, in a March 2026 report, Amazon threat intelligence documented an Interlock intrusion exploiting CVE-2026-20131, demonstrating the group’s ability to exploit network edge devices to achieve initial access. | Interlock ransomware was also deployed through initial access likely facilitated by SocGholish in January 2025, which led to what appears to be the NodeSnake downloader.
PrintNightmare exploit (Interlock staging)
Local privilege escalation exploit CVE-2023-36036 (JunkFiction-crypted) ... CVE CVE-2023-36036 Local privilege escalation exploit used by Interlock and ModeloRAT operators
Interlock ... concealed ... through the custom Hotta Killer evasion tool, which harnesses a zero-day flaw in the legitimate gaming anti-cheat driver GameDriverx64.sys, tracked as CVE-2025-61155, as part of a Bring Your Own Vulnerable Driver attack. ... kernel termination of security software prior to encryption activities.
4 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The Interlock threat actor group uses its own custom ransomware strain, also called "Interlock."
Interlock ransomware is taking a familiar Windows security tool and using it for credential theft.
The Rhysida and Interlock groups, which are known to attack healthcare and other critical infrastructure, have similar TTPs and encryption binaries, leading to some speculation of a connection between the two groups.
The e-crime group is primarily associated with a wide range of malicious tools, including NodeSnake, Interlock RAT, JunkFiction loader, and Interlock ransomware.
29 distinct techniques documented for this family, organized by ATT&CK tactic.
The agencies said they are aware of Interlock encryptors designed for Windows and Linux operating systems and have observed cyber actors obtaining access using an uncommon method of drive-by download from compromised legitimate websites, among other tactics.
Een ongeauthenticeerde externe kwaadwillende kan deze kwetsbaarheid misbruiken door speciaal geprepareerde HTTP-verzoeken naar een getroffen apparaat te sturen.
The Java variant adds two features... The UpdateThread creates a self-deleting scheduled task... Like the Java variant, the PE uses self-deleting scheduled tasks... A daily scheduled task runs the ransomware at 20:00 as SYSTEM.
A PowerShell-based reconnaissance script systematically collects detailed system and network information, including installed software, running services, browser data, and active connections.
The campaign centers around a flaw affecting Cisco Secure Firewall Management Center (FMC) software... It allows an unauthenticated remote attacker to execute arbitrary Java code with root privileges on affected FMC devices... Interlock had already begun exploiting this flaw as early as January 26, 2026.
The Java variant adds two features... The UpdateThread creates a self-deleting scheduled task... Like the Java variant, the PE uses self-deleting scheduled tasks... A daily scheduled task runs the ransomware at 20:00 as SYSTEM.
One of the more advanced components observed in the campaign is a memory-resident webshell. Delivered as a Java class, it operates entirely in memory, avoiding disk-based detection.
XMRIG Driver Loaded ... T1543.003 ... Windows Suspicious Driver Loaded Path
The Java variant adds two features... The UpdateThread creates a self-deleting scheduled task... Like the Java variant, the PE uses self-deleting scheduled tasks... A daily scheduled task runs the ransomware at 20:00 as SYSTEM.
XMRIG Driver Loaded ... T1543.003 ... Windows Suspicious Driver Loaded Path
Other tools found in the attack environment include Volatility... and Certify... These tools enable credential access, privilege escalation, and persistent footholds within compromised environments.
DELETE 0x0c fs.rmSync(__filename)... If the counter passes 40, the implant deletes itself... self-deleting scheduled task... --delete (self-delete after encryption)
DLL execution : loads payloads via rundll32.exe ... rundll32.exe %s,run %s
Delivered as a Java class, it operates entirely in memory, avoiding disk-based detection. It intercepts HTTP requests and executes encrypted payloads dynamically within the Java Virtual Machine.
“...to disable EDR/AV before encrypting...”
The Windows variant imports wevtapi.dll and calls EvtClearLog to wipe Windows event logs. This is the only variant in the toolkit that clears event logs.
Disabled Kerberos Pre-Authentication Discovery With PowerView ... T1558.004
A PowerShell-based reconnaissance script systematically collects detailed system and network information... and active connections.
A PowerShell-based reconnaissance script systematically collects detailed system and network information, including installed software, running services, browser data, and active connections.
MITRE ATT&CK Techniques ID Technique Tactic T1087.002 Domain Account Discovery
The script organizes this data into per-host directories on a centralized network share, compressing it into ZIP archives for exfiltration.
The script organizes this data into per-host directories on a centralized network share, compressing it into ZIP archives for exfiltration.
One variant, written in JavaScript... establish[es] encrypted communication with command-and-control servers via WebSockets.
Interlock employs a Bash script that converts compromised Linux servers into HTTP reverse proxies. These proxies forward traffic to attacker-controlled systems while erasing logs every five minutes.
This triggered the next phase of the attack, where Interlock issued commands to download and execute a malicious Linux binary.
The group deployed ConnectWise ScreenConnect, a commercial remote desktop tool, to maintain access while avoiding detection.
Messages are encrypted using RC4 with unique keys for each transmission.
“…remain on a compromised server for more than a week and steal data… ‘extortion through large-scale data exfiltration and ransomware.’”
Attackers who infiltrated the District's systems on June 3 were able to pilfer data, including current and former names, birthdates, Social Security numbers, state-issued ID details, and financial account information.
Such activity is significant as it often indicates ransomware behavior, where files are encrypted and the originals are deleted.
When You Pay the Ransom - Taking Apart an Interlock ESXi Decryptor ... Taking apart a freshly compiled Interlock ESXi decryptor, and what it reveals about how the encryptor works.
InterLock is a double-extortion ransomware operation... The group exfiltrates data before encrypting, runs a Tor-based leak site...
71 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
65 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Ransomware group mentioned as having exploited a separate FMC zero-day earlier in 2026.
Interlock is discussed in the context of an ESXi decryptor, indicating ransomware tooling used to decrypt files after payment and revealing details about how the corresponding encryptor works.
A ransomware family/group associated with publishing stolen employee data after payment demands were refused.
Ransomware family/group mentioned as responsible for several attacks against the education sector in the period discussed.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.