Interlock

Interlock is a ransomware group first observed in late September 2024. A joint advisory (AA25-203A) was released on July 22, 2025 by the FBI, CISA, the Department of Health and Human Services (HHS) and the Multi-State Information Sharing and Analysis Center (MS-ISAC). It says the group has hit businesses and critical infrastructure in North America and Europe.

Who they target and why

The FBI says the actors pick victims based on opportunity, and that the activity is financially motivated. The advisory does not name a list of favored sectors, so treat any organization with exposed virtual machines as a possible target. HHS co-signed the advisory and it points healthcare organizations to their sector guidance.

How they get in

The unusual part is the front door. The FBI saw the actors gain access through drive-by downloads from compromised legitimate websites, which the advisory calls an uncommon method among ransomware groups. A drive-by download means a person visits a normal-looking site and a malicious file is delivered without any clear warning. The payloads were disguised as fake Google Chrome or Microsoft Edge updates. The actors also used ClickFix, a trick where a fake CAPTCHA page asks the user to paste and run a command, which hands the attacker a foothold.

Inside the network

Once in, the actors use command and control tools such as Cobalt Strike and SystemBC. They steal credentials, use Remote Desktop Protocol (RDP) with stolen accounts to move between machines, and use remote access tools such as AnyDesk and PuTTY. The advisory says they have compromised domain administrator accounts, possibly with a Kerberoasting attack. Data leaves the network through Azure Storage Explorer or file transfer tools such as WinSCP.

Extortion style

Interlock uses double extortion: it steals data first, then encrypts. The ransom note gives no amount. It gives a unique code and a Tor address, and the victim has to make contact first. Payment is requested in Bitcoin. The advisory says the actors have followed through on threats to publish stolen data. So far the FBI has seen only virtual machines encrypted, with hosts, workstations and physical servers left alone. Encryptors exist for Windows and Linux.

Tools and persistence

Besides Cobalt Strike and SystemBC, the advisory lists Interlock RAT and NodeSnake RAT (as of March 2025) for remote control, and the credential stealers Lumma Stealer and Berserk Stealer. For persistence, the actors drop a file in the Windows Startup folder so a remote access trojan runs at login, or add a registry run key named “Chrome Updater”. For discovery they run PowerShell commands that collect system information, running services, drive information and ARP cache details.

The encryptor

The 64-bit encryptor is disguised as conhost.exe and uses a combined AES and RSA scheme. Encrypted files get the .interlock or .1nt3rlock extension. The ransom note is named !__README__!.txt and is pushed out through group policy objects. For theft, the actors use AzCopy to upload data to an Azure storage blob, as well as WinSCP.

Links to other groups

The authors say open-source reporting points to similarities between the Rhysida and Interlock ransomware variants. The advisory does not say what that means for who runs either group. No law-enforcement takedown of Interlock appears in the sources opened for this page.

Double extortion, per the advisory: data is stolen first, then systems are encrypted. The ransom note carries no demand, only a unique code and a Tor address. Payment is requested in Bitcoin. The actors threaten to publish stolen data on a leak site and have done so before.