Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Interlock, a relatively new ransomware group first observed in September 2024, has gained prominence in 2025 as an opportunistic ransomware operator. Unlike traditional Ransomware-as-a-Service models, Interlock operates without affiliates or public advertisements. The group conducts double extortion campaigns, leveraging compromised websites and multi-stage social engineering techniques to deliver payloads. Interlock's attack chain involves initial access through fake software updaters, execution of PowerShell scripts, and the use of custom remote access trojans. The group has targeted various sectors across North America and Europe, including education, healthcare, technology, and government entities. Notable attacks include the DaVita breach in April 2025 and the ransomware attack on the city of St. Paul, Minnesota in July 2025.

Interlock ransomware is a relatively new but increasingly prominent ransomware threat actor first observed in September 2024 and gaining significant activity in 2025. Unlike typical Ransomware-as-a-Service (RaaS) models that rely on affiliates and public recruitment, Interlock operates as a closed, self-contained group without affiliates or public advertisements, indicating a potentially more controlled and sophisticated operation. Their attack methodology involves double extortion campaigns, where data is not only encrypted but also exfiltrated to pressure victims into paying ransoms to avoid public data leaks. The initial access vector is primarily through social engineering, specifically fake software updaters that trick users into executing malicious payloads. Once inside a network, the group leverages PowerShell scripts for execution and persistence, and deploys custom remote access trojans (RATs) such as Interlock RAT, NodeSnake RAT, and SystemBC, which facilitate lateral movement, reconnaissance, and command and control (C2) communications. The use of tools like Cobalt Strike (noted as s0154) suggests advanced post-exploitation capabilities. The group targets a broad range of sectors including education, healthcare, technology, and government entities across North America and Europe, with notable incidents such as the DaVita breach and the ransomware attack on St. Paul, Minnesota. The tactics, techniques, and procedures (TTPs) employed align with MITRE ATT&CK techniques including scheduled task execution (T1053.005), PowerShell execution (T1059.001), system information discovery (T1082), and defense evasion (T1562.001). The absence of known exploits in the wild suggests that the group relies heavily on social engineering and custom malware rather than exploiting public vulnerabilities. Overall, Interlock represents a medium-severity ransomware threat with sophisticated social engineering and multi-stage attack chains that can cause significant operational disruption and data compromise.

Detailed information about Threat Actor Profile: Interlock Ransomware. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'nodesnake rat'

Filter Threats

Threats Tagged 'nodesnake rat'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility