Interlock ransomware targets VMs via drive-by and social engineering
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Interlock ransomware, active since September 2024, encrypts virtual machines using drive-by downloads and ClickFix social engineering to target organizations across North America and Europe.
Interlock is a financially motivated ransomware variant first observed in late September 2024, targeting business and critical infrastructure organizations across North America and Europe. The threat actors employ a double-extortion model, exfiltrating data before encryption to pressure victims into paying ransom demands. The group uses atypical initial-access techniques including drive-by downloads from compromised legitimate websites (sometimes disguised as browser or security software updates) and the ClickFix social engineering tactic, which tricks users into executing malicious Base64-encoded PowerShell commands via fake CAPTCHA prompts.
Once inside a network, Interlock actors establish persistence via Windows Startup folders or Registry modifications, then use credential-stealing tools (including custom credential stealers, Lumma Stealer, and Berserk Stealer), keyloggers, and legitimate remote access tools (AnyDesk, RDP, PuTTY) to move laterally. They exploit Azure Storage for data exfiltration using AzCopy and WinSCP. The ransomware encryptor (conhost.exe, 64-bit) targets virtual machines running Windows and Linux, using combined AES and RSA encryption; notably, FreeBSD VMs have also been observed as targets. Encrypted files receive .interlock or .1nt3rlock extensions and are accompanied by ransom notes that provide a unique victim code and Tor .onion URL for contact but no initial ransom demand.
FBI has observed the actors targeting victims opportunistically and maintaining operational activity through at least June 2025. The actors use Cobalt Strike, SystemBC, Interlock RAT, and NodeSnake RAT for command and control. CISA and FBI recommend network segmentation, robust EDR on VMs, MFA enforcement, DNS filtering, user training to resist social engineering, timely patching, and offline, encrypted, immutable backups as key mitigations.
Mentioned in this report
Detection guidance
ClickFix-Style Encoded PowerShell Launched From Explorer
PowerShell with an encoded command and hidden window spawned directly by explorer.exe, typical of ClickFix fake-CAPTCHA paste-and-run (Win+R) execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: ClickFix-Style Encoded PowerShell Launched From Explorer
id: e4401667-a14f-5057-b8d1-272cd543f2e5
status: experimental
description: Detects PowerShell started by explorer.exe (Run dialog or paste-and-run)
with a Base64 encoded command and a hidden window, as used in ClickFix fake CAPTCHA
social engineering. Generalises on the parent/child relation and flag combination,
not on a specific payload.
tags:
- attack.execution
- attack.t1204.004
- attack.t1059.001
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith: \explorer.exe
Image|endswith:
- \powershell.exe
- \pwsh.exe
selection_enc:
CommandLine|contains|windash:
- ' -enc'
- ' -EncodedCommand'
selection_hidden:
CommandLine|contains|windash:
- ' -w hidden'
- ' -windowstyle hidden'
- ' -w 1'
- ' -nop'
condition: selection_parent and selection_enc and selection_hidden
falsepositives:
- Administrators launching encoded PowerShell one-liners manually from the Run dialog
- Legacy logon or shortcut-based scripts that use encoded hidden PowerShell
level: medium
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-203a
AzCopy Upload to Azure Blob Storage
azcopy.exe copying/syncing data to a blob.core.windows.net endpoint, matching Interlock data exfiltration to Azure Storage before encryption. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: AzCopy Upload to Azure Blob Storage
id: 5c37803c-d776-52bd-bb78-6d455355b45a
status: experimental
description: Detects azcopy.exe invoked with copy or sync against an Azure Blob Storage
URL, used for bulk data exfiltration to attacker-controlled Azure Storage by ransomware
operators. Review whether the destination account belongs to the organisation.
tags:
- attack.exfiltration
- attack.t1567.002
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \azcopy.exe
- OriginalFileName: azcopy.exe
selection_cmd:
CommandLine|contains:
- ' copy '
- ' cp '
- ' sync '
selection_dest:
CommandLine|contains: .blob.core.windows.net
condition: selection_img and selection_cmd and selection_dest
falsepositives:
- Legitimate backup or data-migration jobs by cloud administrators using AzCopy
- Developers uploading build artifacts to the organisation's own storage accounts
level: medium
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-203a
Conhost.exe Executing Outside System Directories
A process named conhost.exe running from outside System32/SysWOW64, matching the Interlock encryptor masquerading as conhost.exe. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Conhost.exe Executing Outside System Directories
id: a98f89cb-28e7-5c63-a128-bac4ae120145
status: experimental
description: Detects a process named conhost.exe launched from a path other than the
Windows system directories. Interlock ransomware masquerades its 64-bit encryptor
as conhost.exe. Generalises on the name and location mismatch, not on a specific
hash or path.
tags:
- attack.stealth
- attack.t1036.005
- attack.impact
- attack.t1486
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: \conhost.exe
filter_legit:
Image|startswith:
- C:\Windows\System32\
- C:\Windows\SysWOW64\
condition: selection and not filter_legit
falsepositives:
- Forensic or sandbox tooling that copies system binaries to analysis directories
- Portable Windows installation media or mounted offline images running from another
drive letter
level: high
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-203a
1 more detection for this report is in the app — the rules that match its indicators, plus the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. Three days of it free, no card.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-203a
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs