Interlock

Interlock is a financially motivated double-extortion ransomware operation active since at least late 2024. The group steals data prior to encryption and operates a Tor-based leak site to pressure victims through public exposure and regulatory consequences. Victimology includes healthcare, education, government, manufacturing, engineering, construction, and other enterprise and critical-infrastructure organizations in North America and Europe.

Interlock has been observed targeting both Windows and FreeBSD/ESXi environments. Its ransomware tooling includes Windows and ELF encryptors, and reporting links the operation to pre-encryption data theft, victim-specific negotiation workflows, and multi-stage intrusions. On Windows, Interlock has been associated with scheduled-task persistence, event-log clearing, and options to encrypt selected files or directories. Across reporting, the operation is consistently characterized as using encryption plus exfiltration for extortion.

The broader Interlock intrusion toolkit includes custom remote-access malware and credential-access tooling. A backdoor family known as NodeSnake has been associated with the operation in JavaScript, Java, and native Windows variants, providing encrypted WebSocket command and control, shell access, command execution, file transfer, SOCKS5 proxying, self-update, and self-delete. Native variants have also been reported with anti-debugging, DLL execution, and thread-hijacking functionality. Interlock activity has additionally included an NTLM credential theft component, use of ConnectWise ScreenConnect for redundant remote access, PowerShell-based host and network reconnaissance, reverse-proxy infrastructure for traffic laundering, and a memory-resident Java backdoor or web shell used for fileless persistence and post-exploitation.

Initial access has been observed through multiple mechanisms. Interlock has been tied to ClickFix social-engineering lures and to exploitation of edge-facing infrastructure, including active exploitation of CVE-2026-20131 in Cisco Secure Firewall Management Center as a zero-day before public disclosure. Post-compromise activity has included extensive system discovery, collection of browser and network artifacts, use of credential- and certificate-abuse tooling, and deployment of ransomware after access is established and maintained.

Interlock has been linked in reporting to the financially motivated cluster Hive0163 and has been discussed alongside Rhysida because of overlapping tradecraft, though any deeper organizational relationship remains unconfirmed. The operation has been publicly associated with significant attacks against healthcare entities and other enterprises, reinforcing its status as an active ransomware threat with mature post-exploitation capability.