Interlock Ransomware: Attack Chain and Prevention

Interlock Ransomware demonstrates how modern ransomware operations combine social engineering, credential theft, data exfiltration, and file encryption to pressure organizations into paying a ransom. First observed in September 2024, the financially motivated operation has reportedly targeted businesses and critical infrastructure across North America and Europe.

The joint #StopRansomware advisory described in the source document was issued by CISA, the FBI, the Department of Health and Human Services (HHS), and the Multi-State Information Sharing and Analysis Center (MS-ISAC). It highlights techniques such as drive-by downloads and ClickFix social engineering, which exploit user trust rather than relying only on conventional phishing emails.

Understanding the Interlock attack chain helps security teams identify suspicious activity earlier, limit unauthorized access, and improve ransomware readiness. Organizations can also consult CISA's official ransomware guidance: https://www.cisa.gov/stopransomware

The reported Interlock attack chain begins with initial access. Attackers may compromise legitimate websites and use them to distribute fake software updates that resemble trusted applications.

The source document identifies examples impersonating Google Chrome, Microsoft Edge, Cisco Secure Client, and FortiClient. Users who download and execute these malicious installers may unknowingly introduce malware into their systems.

Another technique is ClickFix. Victims encounter a fake CAPTCHA or similar page that instructs them to open the Windows Run dialog, paste clipboard contents, and press Enter. The clipboard content reportedly contains a Base64-encoded PowerShell command that downloads malware.

These techniques show why employees should avoid executing commands supplied by unfamiliar webpages and should obtain software updates through trusted sources.

After the initial payload executes, Interlock reportedly deploys a Remote Access Trojan (RAT) that launches PowerShell scripts to install additional malware.

To maintain access, attackers may place malicious files in the Windows Startup folder and create Registry Run Keys using names such as Chrome Updater. These mechanisms can cause components to execute automatically when a user logs in.

Defenders should investigate unexpected startup entries, unfamiliar scheduled or automatically launched components, and suspicious PowerShell activity. Endpoint monitoring can help identify activity that does not match normal system behavior.

Once persistence is established, attackers gather information about the victim's environment to identify valuable systems and prepare for further movement.

The source advisory describes the use of built-in commands and utilities, including systeminfo, tasklist, Get-Service, Get-PSDrive, and arp -a. These can reveal operating system details, running processes and services, mapped drives, and network configuration.

Security teams should monitor unusual combinations of discovery commands, especially when they appear on systems or under accounts that do not normally perform administrative tasks.

Interlock reportedly uses credential stealers and keyloggers to collect usernames, passwords, browser-stored credentials, and keystrokes.

The advisory also notes malware such as Lumma Stealer and Berserk Stealer, as well as possible Kerberoasting activity targeting domain administrator credentials.

Compromised privileged accounts can give attackers access to critical systems and make further intrusion more difficult to contain. Organizations should enforce multifactor authentication, protect privileged accounts, monitor abnormal authentication, and rotate credentials when compromise is suspected.

After obtaining credentials, attackers may move from one system to another using Remote Desktop Protocol (RDP) and legitimate remote administration tools.

The source document identifies AnyDesk, PuTTY, and ScreenConnect among the tools used in reported activity. Because administrators may legitimately use these tools, malicious activity can blend into normal operations.

Organizations should restrict remote access to authorized users and devices, monitor unusual connections, segment networks, and investigate unexpected use of remote administration software.

Before encrypting systems, Interlock reportedly steals sensitive information to increase pressure on victims during ransom negotiations.

The source document identifies Azure Storage Explorer, AzCopy, and WinSCP as tools used to transfer data. Legitimate utilities can be misused to copy confidential business information to attacker-controlled storage.

The final stage involves ransomware encryptors targeting Windows and Linux systems, including virtual machines. The document describes the use of AES and RSA encryption and file extensions such as .interlock or .1nt3rlock.

Victims are directed to contact the attackers through a Tor website. Rather than immediately specifying a ransom amount, the attackers reportedly begin negotiations after contact is established.

This is known as double extortion: victims face both the disruption caused by encrypted files and the threat that stolen information will be publicly disclosed.

The source advisory maps Interlock activity to the MITRE ATT&CK framework, helping defenders connect observed behaviors with detection, monitoring, and threat hunting.

Examples include Drive-by Compromise (T1189), PowerShell Execution (T1059.001), Registry Run Keys (T1547.001), Remote Desktop Protocol (T1021.001), Exfiltration to Cloud Storage (T1567.002), and Data Encrypted for Impact (T1486).

Security teams can use these mappings to review SIEM alerts, identify gaps in endpoint and network monitoring, and develop detection logic for suspicious behaviors across the attack lifecycle.

The advisory emphasizes defense in depth rather than relying on a single security product. Organizations should combine preventive controls, monitoring, access restrictions, backups, and incident response planning.

Filter malicious websites: Use DNS filtering and web access controls to reduce exposure to malicious downloads and compromised websites.

Patch systems: Regularly update operating systems and internet-facing applications to address known vulnerabilities.

Strengthen identity security: Enforce multifactor authentication and implement strong Identity, Credential, and Access Management (ICAM) practices.

Deploy endpoint protection: Use Endpoint Detection and Response (EDR) to monitor suspicious processes and investigate potential compromise.

Segment networks: Restrict unnecessary communication between systems to limit lateral movement.

Protect backups: Maintain encrypted, immutable, offline backups and regularly test restoration procedures.

Apply least privilege: Limit accounts and applications to the permissions required for their tasks.

Train employees: Explain the risks of fake CAPTCHA pages, unexpected software updates, and instructions to paste commands into system utilities.

Validate defenses: Use the MITRE ATT&CK framework to continuously review detection coverage and identify gaps in security controls.

Interlock Ransomware illustrates how modern ransomware operations can combine initial access, persistence, reconnaissance, credential theft, lateral movement, data exfiltration, and encryption into a coordinated enterprise attack.

Organizations should focus on detecting early-stage attacker behavior rather than waiting until files are encrypted. Strong identity controls, endpoint monitoring, network segmentation, secure backups, employee awareness, and tested incident response procedures can help reduce risk and improve recovery.

By applying CISA-recommended safeguards and continuously validating defenses against the MITRE ATT&CK framework, organizations can strengthen their ability to detect, contain, and recover from ransomware incidents.