MintLoader

MintLoader is a malware payload/loader observed in intrusions attributed to the Interlock ransomware group. Reported Interlock attacks often begin with a MintLoader infection, likely delivered through ClickFix social engineering. In the documented 2025 intrusion against a North American education organization, initial access was assessed as originating from a MintLoader infection on an end-user laptop on March 31, 2025, based on distinct PowerShell activity. That initial chain included a PowerShell download cradle retrieving a payload from 138[.]199[.]156[.]22:8080/<time_since_epoch>, followed by use of a ZIP archive named download.zip containing a legitimate Node.js runtime (node.exe) to execute a malicious JavaScript payload. MintLoader is described as executing the NodeSnakeRAT implant, which Interlock then used for persistence and lateral movement. The broader Interlock intrusion set also involved valid-account abuse, living-off-the-land techniques, data exfiltration with AZcopy, and later ransomware deployment against Windows endpoints and Nutanix hypervisors. High-confidence infrastructure and artifacts directly tied to the MintLoader-linked initial access chain include 138[.]199[.]156[.]22:8080/<time_since_epoch>, download.zip, node.exe, and the JavaScript payload j1wp4vw8.log (SHA1: 63FD5E0811C0BCC7DF9FC3D712F39F829A8D6FF0). Targeting described in the source material centers on U.S. and U.K. education organizations affected by Interlock operations.