Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Interlock, a relatively new ransomware group first observed in September 2024, has gained prominence in 2025 as an opportunistic ransomware operator. Unlike traditional Ransomware-as-a-Service models, Interlock operates without affiliates or public advertisements. The group conducts double extortion campaigns, leveraging compromised websites and multi-stage social engineering techniques to deliver payloads. Interlock's attack chain involves initial access through fake software updaters, execution of PowerShell scripts, and the use of custom remote access trojans. The group has targeted various sectors across North America and Europe, including education, healthcare, technology, and government entities. Notable attacks include the DaVita breach in April 2025 and the ransomware attack on the city of St. Paul, Minnesota in July 2025.

Interlock ransomware is a relatively new but increasingly prominent ransomware threat actor first observed in September 2024 and gaining significant activity in 2025. Unlike typical Ransomware-as-a-Service (RaaS) models that rely on affiliates and public recruitment, Interlock operates as a closed, self-contained group without affiliates or public advertisements, indicating a potentially more controlled and sophisticated operation. Their attack methodology involves double extortion campaigns, where data is not only encrypted but also exfiltrated to pressure victims into paying ransoms to avoid public data leaks. The initial access vector is primarily through social engineering, specifically fake software updaters that trick users into executing malicious payloads. Once inside a network, the group leverages PowerShell scripts for execution and persistence, and deploys custom remote access trojans (RATs) such as Interlock RAT, NodeSnake RAT, and SystemBC, which facilitate lateral movement, reconnaissance, and command and control (C2) communications. The use of tools like Cobalt Strike (noted as s0154) suggests advanced post-exploitation capabilities. The group targets a broad range of sectors including education, healthcare, technology, and government entities across North America and Europe, with notable incidents such as the DaVita breach and the ransomware attack on St. Paul, Minnesota. The tactics, techniques, and procedures (TTPs) employed align with MITRE ATT&CK techniques including scheduled task execution (T1053.005), PowerShell execution (T1059.001), system information discovery (T1082), and defense evasion (T1562.001). The absence of known exploits in the wild suggests that the group relies heavily on social engineering and custom malware rather than exploiting public vulnerabilities. Overall, Interlock represents a medium-severity ransomware threat with sophisticated social engineering and multi-stage attack chains that can cause significant operational disruption and data compromise.

Detailed information about Threat Actor Profile: Interlock Ransomware. Get real-time updates, technical details, and mitigation strategies.

Threat Actor Profile: Interlock Ransomware - Live Threat Intelligence - Threat Radar | OffSeq.com

Threat Actor Profile: Interlock Ransomware

The Interlock ransomware group, active since September 2024, has shown adaptability and innovation in its tactics despite a relatively low victim count. They employ fake browser updates and the ClickFix technique for initial access, followed by a multi-stage attack chain involving PowerShell backdoors, credential stealers, and a custom Remote Access Trojan. The group targets various sectors across North America and Europe, conducting Big Game Hunting and double extortion campaigns. Interlock has been observed improving their tools, including evolving their PowerShell backdoor and modifying their ransom notes to emphasize legal repercussions. The group's focus on maintaining relevance while avoiding large-scale visibility suggests a strategic approach to their operations.

The Interlock ransomware group, active since September 2024, represents a sophisticated and evolving threat actor specializing in targeted ransomware attacks, often referred to as Big Game Hunting. Despite maintaining a relatively low victim count, Interlock demonstrates significant adaptability and innovation in its attack methodologies. Initial access is typically gained through social engineering tactics such as fake browser updates and exploitation of the ClickFix technique, which is known for leveraging vulnerabilities in user interaction flows to deploy malicious payloads. Once inside a network, the group employs a multi-stage attack chain that includes deploying PowerShell backdoors, which allow stealthy and persistent command execution within compromised environments. Additionally, they utilize credential stealers, notably the Berserk Stealer, to harvest sensitive authentication data, facilitating lateral movement and privilege escalation. A custom Remote Access Trojan (RAT), referred to as the Interlock RAT, is also deployed to maintain long-term access and control over infected systems. The group’s operational tactics include double extortion, where data is not only encrypted but also exfiltrated, with threats to leak sensitive information if ransom demands are not met. This approach increases pressure on victims to comply. Interlock has been observed refining their tools continuously, including enhancements to their PowerShell backdoor capabilities and modifications to ransom notes to emphasize potential legal consequences, likely as a psychological tactic to coerce victims. Their strategic focus on avoiding large-scale visibility while maintaining operational effectiveness suggests a deliberate effort to evade detection and prolong their campaigns. The group targets multiple sectors across North America and Europe, indicating a broad geographic and vertical scope.

Detailed information about Interlock ransomware evolving under the radar. Get real-time updates, technical details, and mitigation strategies.

Interlock ransomware evolving under the radar - Live Threat Intelligence - Threat Radar | OffSeq.com

Interlock ransomware evolving under the radar

Interlock Ransomware has recently targeted National Defense Corporation and its subsidiaries, impacting the defense industrial base supply chain. The group's attack on AMTEC, a manufacturer of ammunition and explosives, has exposed sensitive information about global defense contractors and their supply chains. This incident highlights the cascading effects of such attacks on military operations, national security, and intellectual property. The compromised data includes details about contracts, logistics, and distribution networks of major defense corporations. The attack underscores the critical need for robust cybersecurity measures in the defense sector, especially given the potential involvement of state-sponsored actors and the implications for geopolitical influence and espionage.

Interlock Ransomware is a sophisticated ransomware threat actor that has recently targeted entities within the defense industrial base (DIB), specifically focusing on National Defense Corporation and its subsidiaries such as AMTEC, a manufacturer of ammunition and explosives. The attack methodology involves encrypting critical operational data and simultaneously exfiltrating sensitive information related to defense contractors, including contract details, logistics, and distribution networks. This double extortion tactic not only disrupts the availability of essential systems but also threatens confidentiality by threatening to leak intellectual property and sensitive supply chain data. The ransomware campaign appears to leverage a combination of tactics including lateral movement (T1133), service stop (T1489), exploitation of public-facing applications (T1190), data from local system (T1567), remote services (T1021), data destruction (T1491), data manipulation (T1565), valid accounts (T1078), data encrypted for impact (T1486), and data exfiltration (T1490). The absence of known affected software versions or publicly known exploits suggests the adversary may be exploiting zero-day vulnerabilities, supply chain weaknesses, or social engineering vectors to gain initial access. The use of multiple IP addresses and a Tor-based leak site for publishing stolen data indicates a high level of operational security and sophistication, possibly pointing to state-sponsored involvement. The attack has cascading effects on military operations and national security by compromising the integrity and confidentiality of defense supply chains, potentially delaying or degrading defense readiness and exposing strategic defense capabilities to adversaries. This threat highlights the critical need for enhanced cybersecurity frameworks such as CMMC compliance within the defense sector to mitigate risks associated with ransomware and data leaks.

Detailed information about How Interlock Ransomware Affects the Defense Industrial Base Supply Chain. Get real-time updates, technical details, and mitigation s

Title	Severity	Type	Source	Date

Threats Tagged 'double extortion'

Filter Threats

Threats Tagged 'double extortion'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility