Unwrapping the emerging Interlock ransomware attack

Tags

External References

• https://blog.talosintelligence.com/
• https://otx.alienvault.com/

Description

A new ransomware group called Interlock has emerged, targeting various sectors with big-game hunting and double extortion attacks. The group uses a sophisticated delivery chain including a RAT disguised as a browser updater, PowerShell scripts, credential stealers, and keyloggers. They primarily move laterally through RDP and exfiltrate data using Azure Storage Explorer. The Interlock ransomware encrypts files with the .Interlock extension and drops ransom notes. The attackers claim to exploit unaddressed vulnerabilities and justify their actions as holding companies accountable for poor cybersecurity. Analysis suggests possible links to the Rhysida ransomware group based on similarities in tactics and code. The attack timeline indicates a dwell time of about 17 days in the victim's environment.

Date