Loading story…
Interlock ransomware has rapidly evolved into a major threat, targeting healthcare, city governments, and enterprises with advanced social engineering and double extortion tactics. The group employs unique infection chains, including drive-by downloads and deceptive update lures, and leverages cloud-native tools for data exfiltration. Recent incidents have caused significant operational disruptions, especially in healthcare, prompting urgent advisories from CISA and the FBI.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
5 references tracked. Mallory keeps watching after this page renders.
blackfog.com
Open sourcedatabreaches.net
Open sourceblackfog.com
Open sourceblackfog.com
Open sourceblackfog.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Interlock ransomware has been highlighted as a threat actor that gains initial access through **ClickFix-style social engineering** and **fake CAPTCHA** lures rather than relying on a software exploit. The activity described shows operators tricking users into executing malicious actions, then harvesting credentials and moving laterally by abusing identity, access, and configuration weaknesses inside enterprise environments before deploying ransomware. Reporting on the broader ransomware landscape says the threat remains highly effective at scale, with Recorded Future tracking **13,000 victims** and **834 ransomware families or brands** over the past two years. The coverage points to Interlock as an example of how modern ransomware operations can bypass defenses focused mainly on CVE patching and compliance checklists, reinforcing CISA-linked guidance that organizations should prioritize mitigation of attack paths, credential abuse, and lateral movement risks alongside traditional vulnerability management.
Jul 24, 2026
Fortinet/FortiGuard Labs reported that the **Interlock** ransomware group—described as a smaller, non-**RaaS** operation—ran a months-long intrusion campaign primarily targeting the **education sector** in the US and UK. Initial access was observed via **MintLoader**, including “ClickFix” social-engineering lures, followed by post-compromise activity using a JavaScript implant referred to as **NodeSnakeRAT**, lateral movement with valid accounts and living-off-the-land techniques, and broad discovery prior to impact. The operation follows a **double-extortion** pattern, with data exfiltration (including use of `AZcopy`) preceding ransomware deployment, and has been observed impacting both Windows endpoints and **Nutanix** hypervisor environments. A key technical finding is Interlock’s use of a **Bring Your Own Vulnerable Driver (BYOVD)** technique to neutralize endpoint defenses. Researchers identified a custom tool dubbed **“Hotta Killer”** (associated with `polers.dll`) that drops a kernel driver `UpdateCheckerX64.sys`, described as a renamed vulnerable anti-cheat driver (`GameDriverx64.sys`, **CVE-2025-61155**). Because the driver is legitimate and digitally signed, it can pass initial trust checks; once loaded, it is abused for kernel-level process termination to **kill EDR/AV processes**, with reporting noting targeting of **Fortinet** security tooling specifically, enabling subsequent ransomware execution with reduced detection and response capability.
Jun 29, 2026
Sophos reported that the Interlock ransomware group, also tracked as **GOLD EMBRACE**, used legitimate memory-forensics tools including **WinPmem** and **Volatility3** to steal Windows credentials during a March 2026 intrusion. The attack began with a **ClickFix** social-engineering lure on a compromised website after a user searched for Dynamics 365 via ChatGPT and was tricked into pasting a malicious command. That command downloaded PowerShell code and installed a remote-access payload on an unprotected Windows 10 endpoint, giving the attackers an initial foothold. Over roughly 26 hours, the attackers conducted LDAP discovery, privilege escalation, **Kerberoasting**, and NTLM downgrade-based lateral movement before reaching a domain controller. Sophos said Interlock used the forensic tools to extract NTLM and LM hashes, local account data, cached domain credentials, and other secrets, then created new domain-admin accounts, established persistence with a scheduled task and `node.exe`, tampered with Microsoft Defender, exfiltrated sensitive data including AWS credentials, and ultimately deployed ransomware that locked the victim out of hypervisors. The campaign reflects Interlock’s broader double-extortion operations against organizations in North America and Europe, including critical infrastructure, healthcare, and education, and its use of malware such as **NodeSnake** and **InterlockRAT**.
Aug 10, 2026