Interlock and Rhysida within the Ransomware Ecosystem

June 15, 2026, 6:32 p.m.

Description

This analysis examines over two years of observations on the ransomware ecosystem surrounding Interlock and Rhysida threat groups. Hive0163 (Interlock) employs custom malware including NodeSnake, InterlockRAT, JunkFiction downloader, Supper, and Interlock ransomware, with identified links to TAG-124. Rhysida actors utilize Endico downloader, Broomstick, Supper, and Tomb crypter, showing relationships with IceNova operators and ITG23. Strong code overlaps between NodeSnake, JunkFiction downloader, InterlockRAT and Supper indicate shared codebases or common developers. Both groups primarily target U.S. organizations across multiple sectors, using trojanized installers, ClickFix campaigns, and traffic distribution systems for initial access. Analysis of post-exploitation payloads reveals broad, adaptable toolsets including custom WDAC policies, credential phishing tools, and various privilege escalation exploits, demonstrating sophisticated ransomware operations.

External References

https://www.ibm.com/think/x-force/interlock-and-rhysida-within-the-ransonware-ecosystem
https://otx.alienvault.com/pulse/6a2c7a1d041f52879495ac3e
Tags
ransomware
socgholish
vidar
sliver
latrodectus
gootloader
clickfix
systembc
rhysida
portstarter
initial access broker
interlock
trojanized installers
nodesnake
inc
broomstick
modelorat
interlockrat
mintloader
supper
CVE-2026-20131
2026-06-12
berserk stealer
CVE-2023-36036
dave
endico
icenova
junkfiction
mallard
ntlmthief
plus keylogger
supper backdoor
tomb
tomb crypter

Date

  • Created: June 12, 2026, 9:29 p.m.
  • Published: June 12, 2026, 9:29 p.m.
  • Modified: June 15, 2026, 6:32 p.m.

Indicators

  • 41b6815d187a9bd7284fb0919b814eaf310d55452030eb932b32b27b5c473e26
  • c8347069980e0c7b8d42cbf0f2be7bc6e558f8b6cf7ca960f6454926120adf55
  • 7890b116d13a52efe696ce1e2c0ed83029775cf4bea836ce551e71d222ee116f
  • 7ed805c5fc3bd0a4eab3d523483a9cc83b8768ff667875f2318f3bfa4ef68fe2
  • 4fa8d9a20ce9098eddc065cc427e3ccb035bf3306e236c17a67104d79ca040e0
  • dbc316c240067d5495415fca6b8fec28b0d9e41282919d7d124fc645e15f5d4c
  • c15f44d6abb3a2a882ffdc9b90f7bb5d1a233c0aa183eb765aa8bfba5832c8c6
  • 9a0b069640a404939e48af5acec26c922bae44a8fdf26444f20ee4f7989640bc
  • 7389c2d346ef85e469a5ce47ef4cbf55bf3c58075996b8f5596e15fa257d90ad
  • b7b451db845d2fd97996e765156ab9b0a337f58957803896bef72834d8a4d158
  • 89759f741606e3e9e3004978c08a3d8f5d8a887f13dd749c6a3653d9db9283df
  • 690b6cf4205248a3fc5521762c69a24f46958e57621dc97b031e41ec1f381221
  • 7d13460fb3a6c918bd9866e1209fbcd18603304c35240f22571c432c204dc363
  • 396eb0e817d90cf366b5648f9a97c51bfb37737af13dc4a9e1a768885a867dc5
  • c24cb7692b77123387b821f3683966807662217a4c918c32bb97358729c33a1d
  • 12b86190ab3fb916b8901d82fbe996f43417ffa5736df5294a63a440758f158e
  • 913487d5c4514300e1f774af965d046479f0a6612061bcb82b536c7427a49102
  • 84d824231a73df2bfb1793d251f69b30fe32bba0693ff6471ac410dedbdd1d9a
  • aa6e5529831b62cb27211b4918dd6da15ac7e69dbcc8621671dccf6df151c5a2
  • 8e2a3f32479404e195db7dbfd6ae3117122db0fcedccf7fe6abb087763f3ecf2
  • 47363515fbf02bb669f72adfdc1e52c6cdcb4fc4183832a96b5761b6d95f016c
  • 0708a518ef644a3911a717220706190fbd5e5246c533845887c5fbd967953799
  • ff664520f263e30ee0380e496328a93701576f1312d2e33a70297a228a8a49a6
  • b46a3f9a7917a0b0e08979f85c90ff802a3e96d23a19a8727d9d701d5e2088eb
  • a4d0ea40eb9cdcd2da83afbe4d36a634ac85c2cb6d16a83729791cadfeb1f298
  • 27091704a872d9ebbbc3b4273a365b1fcc8dee36e1e8a7b53f6df017a26812ff
  • a9b68f8e125da256ab5fe48e3bb4a72423927d943fe7502e20915b5ad24a5bc2
  • b0e292346b4ab3f83fadd8abcce7cfc5b9d50ef73ad141e8bc4a4689fee13504
  • 5811d60e80a6051ab3bd2651060fce8f1ea8d446a062625b0d2b55bb7b2bad99
  • 0edfad6a8b34b2b419fd254a99394b8f2303d144dbeba7148ef5343e2929fe76
  • 333903c7d22a27098e45fc64b77a264aa220605cfbd3e329c200d7e4b42c881c
  • 4fe36d2cdb90cadd834ecd6d42269e7406b439788a405bca35f0b9f7640e008a
  • 55a02d14de13134e77eb9cc787ac622791b38b74931d1588bb5750b06951c8c0
  • 6190923b28679eb8230010aff9b1d1a4184e8697540cc021a5be38126f3f6d99
  • 21d9ed48d51a5b5edae7eb7f99d1648a3ce7d419bc46234143c37dec4638c60d
  • 83b32b8cf59dbd718d04749fd05f78e9ac8efdb0ffec5dc219a010f124937e6a
  • f34cfdc950124d26b4f2f99b192a4ab7a4163af3143c3b18bc2271ca08d6c899
  • 097f139304307375cd41bb2dc3913166e9f05f0d6bf5aad1efdc081dbf07c68d
  • 16474e9e4773fbc1e0b48a5025fad31b7f084b1beffb9a42687b4d01979885fe
  • ee3e0a9f2b04ebd4badd04e2ce6d4b24a1d0811c1c51e86d147d38919ef8b90f
  • 5070ad8f45e6ee70e1b8a4fdbf78b2c823ca2c47a817fc29b5042b15880f92d9
  • 43f4ca1c7474c0476a42d937dc4af01c8ccfc20331baa0465ac0f3408f52b2e2
  • b204d00dd01da0408978e4101479efbdc977e84ad4a99cdbfd4a3364df964dd0
  • d1caa376cb45b6a1eb3a45c5633c5ef75f7466b8601ed72c8022a8b3f6c1f3be
  • 1192381230fce07ef3f2a86ce746c71f22a7e0b97eea7560a38337844e8f3041
  • 0e13ca9e55fbe5ae323f7f295dde8d68aaca3e2c737999174691bee77525de99
  • 85b8522ab6252a67c812bcfbe3adce392ce715b14cdeaf34d5102d3634d69433
  • c96f1812e0a2d520e6e46e0ec6cd9ba8b5735c57847bea8634b017b7ed8dd8ce
  • 8cc335a675f86c691ae04f31b4098fc5761d4e41abfdcbdf3c1016c9e9440490
  • 705127c9730dcdebfa0f30103952107098d164d1941c400ea1f3ff454951c225
  • 082a6286953c0f4256751f1c9bf4c06d4c14fc63f601a78e2f70f7ebd42821cb
  • b659389cde06f5e01e592dca458fe1be07a302c40dc2a820c7f76d4ee788bad3
  • a07ddb6d55f122b056d594fd2efaadacdcb2eab6f65e6f0766684773300a7859
  • 5b7ee3d9f851363d4291689f9ac1a02e18ea024c7ab28009b032a60701639a5d
  • 28a9982cf2b4fc53a1545b6ed0d0c1788ca9369a847750f5652ffa0ca7f7b7d3
  • bc2b7627c5e02e5d8c6311955f1a5c09c62b511aba87b90e493c59c7d360c263
  • 64a0ab00d90682b1807c5d7da1a4ae67cde4c5757fc7d995d8f126f0ec8ae983
  • c9920e995fbc98cd3883ef4c4520300d5e82bab5d2a5c781e9e9fe694a43e82f
  • 66f9c0eb64db7fac127d3d6d2a5a65de6b00bf2b78146a5acecdba2c628b1753
  • f962e15c6efebb3c29fe399bb168066042b616affddd83f72570c979184ec55c
  • b1444193923ca6f71c70c6a45011378ef00459c8a0795da6e1637ef74a24facb
  • 4e4a3751581252e210f6f45881d778d1f482146f92dc790504bfbcd2bdfa0129
  • ec90465dbe3e2846be394bc2d76ddffdee4834086bcc65a6f43535f51333a7d5
  • ea1a0bb1bc5eb31b85675dc91370ee26a8bc6571b0c21a8fc5faa58e67fa01ac
  • 604f7aa77a14f07baa21e76b73ceb7970037bfbdcc2040bf2e445702e99587a0
  • 2528df60e55f210a6396dd7740d76afe30d5e9e8684a5b8a02a63bdcb5041bfc
  • 966908e8863bb78cdd66d29f1d425578cdd2035b6045b86fd8418bfde5e34986
  • dc3c1616b70ab3a8b9c25e46fa00f04e18364909ca7ed5b2698f58918e0ccef3
  • 72bed9b26a7747252156b65d24a9a737d70b9bf6aca069c514c1c7b9e04ef9b6
  • 9422d19bca175bf0727336b6ed5bef01c81e5a80dfdaebf4d7cde9ebfb4ef44e
  • dea7885448e9a75ab45bd0b08a01f548c37e7d012cd519c4b8a85941d359e26b
  • 170.168.103.208
  • 185.233.166.26
  • 213.139.77.167
  • 64.94.84.155
  • 162.221.93.164
  • 193.36.38.139
  • 64.94.85.158
  • 199.217.99.95
  • 192.169.6.74
  • 67.217.228.180
  • 157.250.195.229
  • 198.13.158.219
  • 199.91.221.250
  • 216.219.95.234
  • 5.230.201.173
  • 185.196.9.234
  • 199.217.99.121
  • 45.84.59.21
  • 199.91.221.73
  • 38.134.148.147
  • 193.149.176.215
  • https://apple-online.shop/ChromeSetup.exe
  • https://leadslaw.com/MSTeamsSetup.exe
  • https://microsoft-teams.icu/files/MSteamsV7.80.exe
  • www.nomok-xore.com
  • https://apple-online.shop/MSTeamsSetup.exe\
  • www.forever-size.com
  • https://hire-household-squad-postcard.trycloudflare.com/MSTeamsSetup.exe
  • https://apple-online.shop/MSTeamsSetup.exe
  • www.deyno-xom.com
  • https://apple-online.shop/MicrosoftEdgeSetup.exe\
Download all indicators here!

Attack Patterns

  • Tomb
  • ModeloRAT
  • Brave Prince - S0252
  • Latrodectus
  • NtlmThief
  • SystemBC
  • InterlockRAT
  • Endico
  • Sliver
  • MintLoader
  • Vidar
  • Gootloader
  • NodeSnake
  • JunkFiction
  • Plus Keylogger
  • Mallard
  • Supper
  • Broomstick
  • Dave
  • Rhysida
  • Interlock
  • Berserk Stealer
  • SocGholish
  • PortStarter
  • Hive0163, Rhysida, Vanilla Tempest, TAG-124, ITG23

Additional Informations

  • Energy
  • Agriculture
  • Finance
  • Education
  • Manufacturing
  • Telecommunications
  • Hospitality
  • Retail
  • Technology
  • Construction
  • Media
  • Aerospace
  • NGO
  • Chemical
  • Defense
  • Healthcare
  • Transportation
  • Government
  • scs-techresources.com
  • repair-provision-supplies-folder.trycloudflare.com
  • second.ms-updated-service.com
  • nucleusgate.com
  • year.giver-tuyk.org
  • nimoloxanulokol.com
  • locals.best-default-server.com
  • utility-include-clubs-measurement.trycloudflare.com
  • microsoft-teams.icu
  • lamp-voters-biodiversity-phillips.trycloudflare.com
  • secure.connecter-edge.com
  • sos.konowe-sodo.com
  • yum.deyno-xom.com
  • firist.ms-updated-service.com
  • meet-noted-tax-qualification.trycloudflare.com
  • albany-motels-visibility-bus.trycloudflare.com
  • updt-ms-srv.org
  • auth-ms-service.site
  • auth-ms-service.org
  • maines.forever-size.com
  • liabilities-complications-discussing-temporal.trycloudflare.com
  • registrywave.com
  • corner-teacher-guam-characterization.trycloudflare.com
  • medhurstwaelcci.net
  • first.best-default-server.com
  • os-update-server.com
  • leadslaw.com
  • aaa.load-edge-service.com
  • clouds.forever-size.com
  • flowmiceornfidgring.cc
  • no-global.qomaun-upd.com
  • moore-cgi-pen-drove.trycloudflare.com
  • os-update-server.live
  • time.konowe-sodo.com
  • rpm-chicken-during-staying.trycloudflare.com
  • updt-ms-srv.com
  • specials-storm-height-warriors.trycloudflare.com
  • dex.nomok-xore.com
  • nelavohomet.com
  • tmp.alomo-pofo.org
  • hire-household-squad-postcard.trycloudflare.com
  • dpf.nomok-xore.com
  • ms-sql-auth.com
  • survivors-troops-interesting-learned.trycloudflare.com
  • mails.alomo-pofo.org
  • partyglacierhip.top
  • os-update-server.top
  • fix.connecter-edge.com
  • os-update-server.org
  • secured.best-default-server.org
  • dev.konowe-sodo.com
  • reduce-highest-acknowledge-apparent.trycloudflare.com
  • default.ms-updated-service.com
  • mail.load-edge-service.com
  • carlo-payment-bullet-grocery.trycloudflare.com
  • mail.best-default-server.site
  • last.best-default-server.org
  • updt-ms-srv.site
  • johnny-republicans-muscles-partners.trycloudflare.com
  • baseline-include-priority-bar.trycloudflare.com
  • mailed.load-edge-service.com
  • coretether.com
  • donnellykilbakk.cc
  • misc-elliott-mouth-leading.trycloudflare.com
  • muscle-european-entering-bigger.trycloudflare.com
  • country-character-how-charging.trycloudflare.com
  • describe-absent-operational-seventh.trycloudflare.com
  • eugene-examinations-contained-timber.trycloudflare.com
  • apt.deyno-xom.com
  • ssh.qomaun-upd.com
  • bits-promotions-turned-editions.trycloudflare.com
  • edinburgh-packaging-sense-idol.trycloudflare.com
  • heap.best-default-server.site
  • jane-practitioner-lightning-preservation.trycloudflare.com
  • orearch.giver-tuyk.org
  • kolinhumercianali.org
  • postal-ssl-converted-quantity.trycloudflare.com
  • browser-updater.com
  • screenshots-executive-joins-hammer.trycloudflare.com
  • liverpool-patterns-lanes-specified.trycloudflare.com
  • confident-accounts-ban-damaged.trycloudflare.com
  • browser-updater.live
  • cigarette-assumed-biotechnology-checklist.trycloudflare.com
  • coffee-lloyd-families-excluded.trycloudflare.com
  • typically-performer-builds-increasing.trycloudflare.com
  • status.connecter-edge.com
  • updt-ms-srv.top
  • glasgow-thank-del-heard.trycloudflare.com
  • United States of America

Linked vulnerabilities

CVE-2023-36036

None
Published:

CVE-2026-20131

10.0
    Cisco
  • Cisco Secure Firewall Management Center
Published: March 4, 2026