Interlock, a relatively new ransomware group first observed in September 2024, has gained prominence in 2025 as an opportunistic ransomware operator. Unlike traditional Ransomware-as-a-Service models, Interlock operates without affiliates or public advertisements. The group conducts double extortion campaigns, leveraging compromised websites and multi-stage social engineering techniques to deliver payloads. Interlock's attack chain involves initial access through fake software updaters, execution of PowerShell scripts, and the use of custom remote access trojans. The group has targeted various sectors across North America and Europe, including education, healthcare, technology, and government entities. Notable attacks include the DaVita breach in April 2025 and the ransomware attack on the city of St. Paul, Minnesota in July 2025.
A wide-ranging phishing campaign has been identified that enables threat actors to bypass traditional security controls and delay detection. The campaign, tracked since 2024, has facilitated remote surveillance, credential theft, lateral movement, data exfiltration, and ransomware across numerous organizations. The likely new or rebranded cybercriminal group behind this campaign uses legitimate services like TryCloudflare to host and deliver highly evasive malware such as AsyncRAT and other Remote Access Trojans. This malware allows threat actors to remotely control infected networks throughout the full attack lifecycle. The campaign targets organizations globally across multiple sectors without industry preference, using widely available malware and difficult-to-detect techniques involving Python scripts, obfuscated batch scripts, trusted cloud services, and dynamic infrastructure.
