Tag: interlock

6 Attack Reports | 0 Vulnerabilities

Attack reports

A Slopoly start to AI-enhanced ransomware attacks

IBM X-Force discovered a likely AI-generated malware named 'Slopoly' used in a ransomware attack by the Hive0163 group. This marks the beginning of AI adoption among cybercrime groups, potentially transforming the threat landscape. Slopoly, while relatively unsophisticated, demonstrates how easily …
ransomware
cybercrime
clickfix
interlock
nodesnake
interlockrat
ai-generated malware
2026-03-17
slopoly
Published: March 17, 2026
Downloadable IOCs: 2

Weekly Threat Bulletin – January 28th, 2026

This weekly threat bulletin highlights several critical vulnerabilities and emerging threats. A severe RCE vulnerability in React Server Components and Next.js (CVE-2025-55182) is being actively exploited. CISA added four critical flaws to its 'Must-Patch' list, including vulnerabilities in Versa C…
ransomware
xmrig
cobalt strike
macos
mirai
sliver
gafgyt
qilin
cisa
interlock
rce
lizkebab
bashlite
aisuru
clop
vshell
next.js
CVE-2025-31125
CVE-2025-34026
pulsepack
rondodox
CVE-2025-54313
beacon
morte
CVE-2025-61882
oracle e-business suite
nezha
agenda
CVE-2025-55182
react
peerblight
etherrat
CVE-2025-68645
rondo
monetastealer
gitlab
2026-01-28
agendacrypt
angryrebel
bash0day
bpfdoor
compood
kswapdoor
lzrd
masuta
miori
noodle rat
okiru
puremasuta
resgod
rondobot
satori
scavenger
splinter
torlus
wicked
Published: January 28, 2026
Linked vulnerabilities : CVE-2025-24893 (CVSS 9.8), CVE-2023-1389, CVE-2025-31125 (CVSS 5.3), CVE-2025-34026 (CVSS 9.2), CVE-2025-54313 (CVSS 7.5), CVE-2025-61882 (CVSS 9.8), CVE-2025-55182 (CVSS 10.0), CVE-2025-66478, CVE-2025-55184 (CVSS 7.5), CVE-2025-55183 (CVSS 5.3), CVE-2025-68645 (CVSS 8.8), CVE-2025-13335 (CVSS 6.5), CVE-2025-13927 (CVSS 7.5), CVE-2025-13928 (CVSS 7.5), CVE-2026-0723 (CVSS 7.4), CVE-2026-1102 (CVSS 5.3)
Downloadable IOCs: 37

Interlock Ransomware Targeting Businesses

The Interlock ransomware group has been actively targeting businesses and critical infrastructures in North America and Europe since September 2024. Their ransomware employs AES-256-GCM encryption with RSA-4096 key protection, leveraging the OpenSSL library for efficient file encryption. The malwar…
ransomware
data theft
europe
interlock
file encryption
code obfuscation
2025-08-29
openssl
north america
aes-256-gcm
rsa-4096
Published: August 29, 2025
Downloadable IOCs: 0

Analysis of Interlock Ransomware Attack on Healthcare Facilities

The Interlock ransomware group has been actively targeting healthcare facilities in the United States, causing significant disruptions and exposing sensitive patient data. The attacks involve drive-by compromise techniques, using fake software updaters to deploy malware. The group employs double-ex…
ransomware
credential theft
healthcare
lateral movement
data exfiltration
double-extortion
interlock
2025-01-28
drive-by compromise
Published: January 28, 2025
Downloadable IOCs: 0

Ransomware Roundup - Interlock

The Interlock ransomware is a new variant targeting Microsoft Windows and FreeBSD systems. It encrypts files and demands ransom for decryption. The malware has both Windows and FreeBSD versions, using AES-CBC encryption and adding a '.interlock' extension to encrypted files. It excludes certain fil…
ransomware
encryption
interlock
2024-12-03
Published: December 3, 2024
Downloadable IOCs: 5

Unwrapping the emerging Interlock ransomware attack

A new ransomware group called Interlock has emerged, targeting various sectors with big-game hunting and double extortion attacks. The group uses a sophisticated delivery chain including a RAT disguised as a browser updater, PowerShell scripts, credential stealers, and keyloggers. They primarily mo…
rat
ransomware
azure
rdp
keylogger
double-extortion
rhysida
2024-11-07
credential-stealer
interlock
Published: November 7, 2024
Downloadable IOCs: 2
Click here to see more Attack Reports