- FBI, CISA, HHS, and MS-ISAC issue a joint statement on Interlock
- They described the group’s MO and usual tactics
- The advisory details mitigation techniques, too
The Federal Bureau of Investigation (FBI) is urging organizations to beware of ransomware attacks from the increasingly-notororious Interlock ransomware group.
In a new security advisory, jointly published with the Cybersecurity and Infrastructure Security Agency (CISA), the Department of Health and Human Services (HHS), and Multi-State Information Sharing and Analysis Center (MS-ISAC), Interlock was described as a financially-motivated ransomware group first spotted in September 2024.
The group usually targets businesses and critical infrastructure organizations in North America and Europe, engaging in the usual double-extortion tactic – stealing data, then encrypting systems to coerce victims into paying. It adds more pressure by threatening to release the files on the dark web, too.
Rich tech stack
Describing Interlock’s methodology, the agencies said they usually gain initial access through drive-by downloads from compromised websites, fake browser and security updates, or ClickFix tactics.
Once initial access is established, the crooks would drop a myriad of tools that would grant them different abilities: PowerShell-based remote access trojans (RAT) for access, Lumma, Berserk, and other keyloggers for credential theft, various registry key modifications for system info gathering, AnyDesk, PuTTY, or ScreenConnect for lateral movement, and CobaltStrike, SystemBC, and others for command-and-control.
Interlock has developed encryptors for both Windows and Linux, it was further explained, with files getting either a .interlock, or a .1nt3rlock extension. The group has no upfront demands, their ransom note only contains a Tor link for negotiations, which are usually capped to 96 hours.
The FBI also said that it spotted some overlaps with another ransomware group called Rhysida, suggesting potential team-ups, or simply using the same infrastructure.
To defend against Interlock, FBI and friends recommend businesses patch their systems and software, use DNS filtering and web firewalls, enforce multi-factor authentication (MFA) and strong access controls wherever possible, segment their networks to limit spread, and deploy robust EDR tools, especially for virtual machines.
