# Interlock ransomware group deploys new PHP RAT variant

Published: 2025-07-14 · Severity: high
Canonical: https://vorant.io/reports/2c2d04ef-25d5-4d41-b304-8ebaa3de0bb7/interlock-ransomware-group-deploys-new-php-rat-variant

> The Interlock ransomware group has shifted from JavaScript to a new PHP-based remote access trojan, delivered via compromised websites using KongTuke web-inject techniques since May 2025.

Researchers from The DFIR Report and Proofpoint have identified a significant evolution in the Interlock ransomware group's tooling. Since May 2025, the threat actor has deployed a new PHP-based variant of their remote access trojan, marking a departure from the previously documented JavaScript-based Interlock RAT (NodeSnake). The malware is delivered through a sophisticated web-inject campaign leveraging compromised websites that present fake CAPTCHA verification prompts, ultimately tricking users into executing PowerShell commands that install the RAT.

The PHP variant demonstrates advanced capabilities including automated reconnaissance through PowerShell commands to collect system information, privilege checks, and network enumeration. The malware establishes command-and-control communications via Cloudflare Tunnel URLs (trycloudflare.com) with hardcoded fallback IP addresses for resilience. It supports multiple execution methods including downloading and running executables, DLLs, arbitrary shell commands, and establishes persistence through Windows Registry run keys. Operators have been observed conducting interactive sessions with manual Active Directory enumeration, specifically searching for backup systems, before moving laterally via RDP.

The campaign appears opportunistic, targeting multiple industry sectors rather than focusing on specific verticals. The transition from the KongTuke FileFix delivery mechanism to deploy both PHP and Node.js RAT variants demonstrates the group's operational agility and continued sophistication in maintaining access to victim networks.

## Mentioned in this report

- Threat actors: interlock
- Malware: Interlock RAT, KongTuke, LandUpdate808, NodeSnake

## Detection guidance (public sample)

### Suspicious PowerShell Execution Spawned from Explorer (Fake CAPTCHA / ClickFix Pattern)

ATT&CK: T1059.001

Detects PowerShell launched directly by explorer.exe with download/execute or encoded command flags, consistent with fake CAPTCHA pages tricking users into pasting and running malicious PowerShell via the Run dialog. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Suspicious PowerShell Execution Spawned from Explorer
id: f7359ddd-0f50-5ebf-b36b-fa1a7bc51696
status: experimental
description: Detects PowerShell processes launched directly from explorer.exe containing
  download/execute or encoded command patterns, matching the ClickFix/fake CAPTCHA
  delivery technique used to install the Interlock PHP RAT.
references:
- DFIR Report / Proofpoint Interlock PHP RAT reporting
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: \explorer.exe
  selection_ps:
    Image|endswith: \powershell.exe
  selection_flags:
    CommandLine|contains:
    - -enc
    - -EncodedCommand
    - IEX
    - DownloadString
    - Invoke-Expression
    - -WindowStyle Hidden
    - -w hidden
  condition: selection_parent and selection_ps and selection_flags
falsepositives:
- IT administrators or helpdesk scripts launched manually via Run dialog for legitimate
  troubleshooting
- Software deployment tools that spawn PowerShell from explorer.exe under unusual
  configurations
level: high
tags:
- attack.t1059.001
- attack.t1204.001
- attack.t1189
author: Vorant
```

### Network Connection to Cloudflare Tunnel (trycloudflare.com) Subdomain

ATT&CK: T1071.001

Detects DNS queries or outbound connections to trycloudflare.com subdomains, used by Interlock PHP RAT for resilient C2 communication and multi-hop proxying. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: DNS Query to Cloudflare Tunnel Subdomain (trycloudflare.com)
id: ea0933f0-3993-5c4e-beb5-d6892e38f3ee
status: experimental
description: Detects DNS resolution or network connections to trycloudflare.com subdomains,
  a technique used by Interlock RAT operators to establish resilient C2 channels via
  Cloudflare Tunnel infrastructure combined with hardcoded fallback IPs.
references:
- DFIR Report / Proofpoint Interlock PHP RAT reporting
logsource:
  category: dns_query
  product: windows
detection:
  selection:
    QueryName|endswith: .trycloudflare.com
  condition: selection
falsepositives:
- Legitimate use of Cloudflare Tunnel for internal application exposure or developer
  testing
- Third-party SaaS integrations using Cloudflare Tunnel for remote access
level: medium
tags:
- attack.t1071.001
- attack.t1090.003
author: Vorant
```

### Registry Run Key Persistence Added via Command-Line Utility

ATT&CK: T1547.001

Detects creation of a Registry Run key value via reg.exe or PowerShell pointing to a script or executable in a user-writable directory, consistent with Interlock RAT establishing persistence after initial installation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Registry Run Key Persistence via reg.exe or PowerShell
id: a0d6b273-511a-5838-9b8d-bc39ab46285a
status: experimental
description: Detects registry modifications adding a value to Run/RunOnce keys via
  reg.exe or PowerShell, where the value data references an executable or script in
  a user-writable path (AppData, Temp, ProgramData), matching Interlock RAT's persistence
  mechanism.
references:
- DFIR Report / Proofpoint Interlock PHP RAT reporting
logsource:
  category: registry_set
  product: windows
detection:
  selection_key:
    TargetObject|contains:
    - \Software\Microsoft\Windows\CurrentVersion\Run
    - \Software\Microsoft\Windows\CurrentVersion\RunOnce
  selection_path:
    Details|contains:
    - \AppData\
    - \Temp\
    - \ProgramData\
  filter_common:
    Image|endswith:
    - \msiexec.exe
    - \TrustedInstaller.exe
  condition: selection_key and selection_path and not filter_common
falsepositives:
- Legitimate software installers that register update or helper executables under
  user profile paths
- IT-managed scripts placing startup shortcuts in AppData for approved applications
level: medium
tags:
- attack.t1547.001
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://thedfirreport.com/2025/07/14/kongtuke-filefix-leads-to-new-interlock-rat-variant

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/2c2d04ef-25d5-4d41-b304-8ebaa3de0bb7/interlock-ransomware-group-deploys-new-php-rat-variant.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup