Interlock ransomware group deploys new PHP RAT variant
The Interlock ransomware group has shifted from JavaScript to a new PHP-based remote access trojan, delivered via compromised websites using KongTuke web-inject techniques since May 2025.
Sourcethedfirreport.com — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
Researchers from The DFIR Report and Proofpoint have identified a significant evolution in the Interlock ransomware group's tooling. Since May 2025, the threat actor has deployed a new PHP-based variant of their remote access trojan, marking a departure from the previously documented JavaScript-based Interlock RAT (NodeSnake). The malware is delivered through a sophisticated web-inject campaign leveraging compromised websites that present fake CAPTCHA verification prompts, ultimately tricking users into executing PowerShell commands that install the RAT.
The PHP variant demonstrates advanced capabilities including automated reconnaissance through PowerShell commands to collect system information, privilege checks, and network enumeration. The malware establishes command-and-control communications via Cloudflare Tunnel URLs (trycloudflare.com) with hardcoded fallback IP addresses for resilience. It supports multiple execution methods including downloading and running executables, DLLs, arbitrary shell commands, and establishes persistence through Windows Registry run keys. Operators have been observed conducting interactive sessions with manual Active Directory enumeration, specifically searching for backup systems, before moving laterally via RDP.
The campaign appears opportunistic, targeting multiple industry sectors rather than focusing on specific verticals. The transition from the KongTuke FileFix delivery mechanism to deploy both PHP and Node.js RAT variants demonstrates the group's operational agility and continued sophistication in maintaining access to victim networks.
Mentioned in this report
Detection guidance
Suspicious PowerShell Execution Spawned from Explorer (Fake CAPTCHA / ClickFix Pattern)
A behavioural hunt for the technique in general.
Detects PowerShell launched directly by explorer.exe with download/execute or encoded command flags, consistent with fake CAPTCHA pages tricking users into pasting and running malicious PowerShell via the Run dialog. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious PowerShell Execution Spawned from Explorer
id: f7359ddd-0f50-5ebf-b36b-fa1a7bc51696
status: experimental
description: Detects PowerShell processes launched directly from explorer.exe containing
download/execute or encoded command patterns, matching the ClickFix/fake CAPTCHA
delivery technique used to install the Interlock PHP RAT.
references:
- DFIR Report / Proofpoint Interlock PHP RAT reporting
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith: \explorer.exe
selection_ps:
Image|endswith: \powershell.exe
selection_flags:
CommandLine|contains:
- -enc
- -EncodedCommand
- IEX
- DownloadString
- Invoke-Expression
- -WindowStyle Hidden
- -w hidden
condition: selection_parent and selection_ps and selection_flags
falsepositives:
- IT administrators or helpdesk scripts launched manually via Run dialog for legitimate
troubleshooting
- Software deployment tools that spawn PowerShell from explorer.exe under unusual
configurations
level: high
tags:
- attack.t1059.001
- attack.t1204.001
- attack.t1189
author: Vorant
Network Connection to Cloudflare Tunnel (trycloudflare.com) Subdomain
A behavioural hunt for the technique in general.
Detects DNS queries or outbound connections to trycloudflare.com subdomains, used by Interlock PHP RAT for resilient C2 communication and multi-hop proxying. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: DNS Query to Cloudflare Tunnel Subdomain (trycloudflare.com)
id: ea0933f0-3993-5c4e-beb5-d6892e38f3ee
status: experimental
description: Detects DNS resolution or network connections to trycloudflare.com subdomains,
a technique used by Interlock RAT operators to establish resilient C2 channels via
Cloudflare Tunnel infrastructure combined with hardcoded fallback IPs.
references:
- DFIR Report / Proofpoint Interlock PHP RAT reporting
logsource:
category: dns_query
product: windows
detection:
selection:
QueryName|endswith: .trycloudflare.com
condition: selection
falsepositives:
- Legitimate use of Cloudflare Tunnel for internal application exposure or developer
testing
- Third-party SaaS integrations using Cloudflare Tunnel for remote access
level: medium
tags:
- attack.t1071.001
- attack.t1090.003
author: Vorant
Registry Run Key Persistence Added via Command-Line Utility
A behavioural hunt for the technique in general.
Detects creation of a Registry Run key value via reg.exe or PowerShell pointing to a script or executable in a user-writable directory, consistent with Interlock RAT establishing persistence after initial installation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Registry Run Key Persistence via reg.exe or PowerShell
id: a0d6b273-511a-5838-9b8d-bc39ab46285a
status: experimental
description: Detects registry modifications adding a value to Run/RunOnce keys via
reg.exe or PowerShell, where the value data references an executable or script in
a user-writable path (AppData, Temp, ProgramData), matching Interlock RAT's persistence
mechanism.
references:
- DFIR Report / Proofpoint Interlock PHP RAT reporting
logsource:
category: registry_set
product: windows
detection:
selection_key:
TargetObject|contains:
- \Software\Microsoft\Windows\CurrentVersion\Run
- \Software\Microsoft\Windows\CurrentVersion\RunOnce
selection_path:
Details|contains:
- \AppData\
- \Temp\
- \ProgramData\
filter_common:
Image|endswith:
- \msiexec.exe
- \TrustedInstaller.exe
condition: selection_key and selection_path and not filter_common
falsepositives:
- Legitimate software installers that register update or helper executables under
user profile paths
- IT-managed scripts placing startup shortcuts in AppData for approved applications
level: medium
tags:
- attack.t1547.001
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://thedfirreport.com/2025/07/14/kongtuke-filefix-leads-to-new-interlock-rat-variant
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the actors and malware it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs