Loading story…
A fake CAPTCHA social-engineering lure was used to gain initial access in an intrusion later tied to the Interlock ransomware group. Investigators found that a user was tricked into pasting and running a malicious PowerShell command through the Windows Run dialog, launching a staged infection chain that downloaded and executed a payload from rebrand[.]ly/openCaptcha into the victim's %TEMP% directory as KjGryNSu.exe.
Analysis of the PowerShell stage showed the script suppressed normal output, fetched the executable, and ran it, leading to deployment of Supper, a heavily obfuscated DLL backdoor that provided command execution, DLL loading, credential theft, and lateral movement capability. Beazley Security also observed the attackers installing CrossTec and using a Dormouse installer, while law-enforcement data from a seized server linked the activity log for the intrusion to Interlock, indicating the operation was likely intended to end in ransomware deployment.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
Law enforcement later informed the targeted organization that an activity log recovered from a seized server tied the intrusion to the emerging Interlock ransomware group. This clarified that the likely end goal of the operation was ransomware deployment.
Beazley Security's MXDR and MDR teams identified, responded to, and contained the intrusion in a client environment late last year before broader compromise occurred. At that stage, Beazley had not yet confirmed the attackers' final objective.
Beazley's earlier observations showed the threat actor attempting commands to extract the SAM hive, and the Supper implant was assessed as the primary tool for credential theft and lateral activity. This reflected progression beyond initial access toward broader compromise.
Beazley identified the second-stage payload as Supper, a heavily obfuscated DLL-based implant with anti-analysis features. The malware provided command-line access, could execute commands through cmd.exe, and could run supplied DLLs via rundll functionality.
After initial access, the attackers downloaded multiple files and installed CrossTec remote administration software on the compromised machine. Beazley also observed use of a Dormouse installer, which was the notable component used to fetch the next-stage payload.
In the Beazley intrusion, the malicious PowerShell downloaded active.exe and saved it locally as asdin2oe.exe before execution. The separate analysis similarly shows the PowerShell stage downloading an executable into %TEMP% and launching it, confirming staged payload delivery behavior.
Beazley determined that a client intrusion began when a user followed a fake CAPTCHA prompt and pasted a malicious PowerShell command into the Windows Run dialog. A separate malware-analysis reference describes the same lure pattern, where encoded PowerShell downloads and executes a payload from rebrand[.]ly/openCaptcha.
Beazley reported that VirusTotal searches on a hardcoded Supper filename returned 13 related samples first seen from September through December, indicating a broader campaign using similarly named executables and callback infrastructure. Submission data suggested targeting in India, Canada, Germany, the Netherlands, France, and the United States.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Sophos reported that the Interlock ransomware group, also tracked as **GOLD EMBRACE**, used legitimate memory-forensics tools including **WinPmem** and **Volatility3** to steal Windows credentials during a March 2026 intrusion. The attack began with a **ClickFix** social-engineering lure on a compromised website after a user searched for Dynamics 365 via ChatGPT and was tricked into pasting a malicious command. That command downloaded PowerShell code and installed a remote-access payload on an unprotected Windows 10 endpoint, giving the attackers an initial foothold. Over roughly 26 hours, the attackers conducted LDAP discovery, privilege escalation, **Kerberoasting**, and NTLM downgrade-based lateral movement before reaching a domain controller. Sophos said Interlock used the forensic tools to extract NTLM and LM hashes, local account data, cached domain credentials, and other secrets, then created new domain-admin accounts, established persistence with a scheduled task and `node.exe`, tampered with Microsoft Defender, exfiltrated sensitive data including AWS credentials, and ultimately deployed ransomware that locked the victim out of hypervisors. The campaign reflects Interlock’s broader double-extortion operations against organizations in North America and Europe, including critical infrastructure, healthcare, and education, and its use of malware such as **NodeSnake** and **InterlockRAT**.
Aug 10, 2026
Interlock ransomware has been highlighted as a threat actor that gains initial access through **ClickFix-style social engineering** and **fake CAPTCHA** lures rather than relying on a software exploit. The activity described shows operators tricking users into executing malicious actions, then harvesting credentials and moving laterally by abusing identity, access, and configuration weaknesses inside enterprise environments before deploying ransomware. Reporting on the broader ransomware landscape says the threat remains highly effective at scale, with Recorded Future tracking **13,000 victims** and **834 ransomware families or brands** over the past two years. The coverage points to Interlock as an example of how modern ransomware operations can bypass defenses focused mainly on CVE patching and compliance checklists, reinforcing CISA-linked guidance that organizations should prioritize mitigation of attack paths, credential abuse, and lateral movement risks alongside traditional vulnerability management.
Jul 24, 2026
Security researchers reported an active malware distribution technique that abuses **bogus CAPTCHA** pages to trick users into executing attacker-supplied commands on Windows. In the **ClearFake** campaign analyzed by Expel, victims land on a compromised site and are instructed to press `Win + R`, then paste and run a clipboard-seeded command—an approach commonly referred to as **ClickFix**—which results in malicious **PowerShell** execution. The campaign emphasizes *living-off-the-land* tradecraft and evasion, including **proxy execution** by abusing the trusted Windows script `C:\Windows\System32\SyncAppvPublishingServer.vbs` to launch PowerShell in hidden mode and reduce the chance of AV detection. Separate measurement and telemetry on the same broader tactic found large-scale infrastructure supporting fake CAPTCHA lures: a Censys analysis identified **9,494** breached websites hosting counterfeit verification pages, with ~**70%** appearing nearly identical. The most common infection mechanisms involved **clipboard manipulation** leading to **VBScript** and **PowerShell** execution (with significant counts of each observed), alongside other delivery paths such as `MSIEXEC`-based installation of malicious Windows Installer packages. Researchers also observed use of the **Matrix** push command-and-control framework to support **fileless** deployment, noting that these intrusions can leave no traditional executable artifacts and may evade signature-based detection.
Jun 29, 2026