Interlock ransomware debuts PHP RAT via FileFix

Interlock ransomware group is using a new PHP-based RAT delivered through KongTuke/LandUpdate808 fake-CAPTCHA web injects and Cloudflare Tunnels for C2.

The DFIR Report, working with Proofpoint, identified a new PHP variant of the Interlock ransomware group's RAT, a departure from the group's earlier Node.js-based Interlock RAT (NodeSnake). The infection chain begins with compromised legitimate websites injected with a hidden single-line script tied to the LandUpdate808/KongTuke web-inject cluster. Victims are lured through a fake "Verify you are human" CAPTCHA and 'FileFix' verification steps that trick them into pasting and executing a malicious PowerShell command via the Windows Run dialog, which retrieves and launches PHP configured to load the RAT payload.

Once executed, the PHP-based Interlock RAT performs extensive automated discovery (system info, running processes/services, mounted drives, ARP neighbors, privilege level) and exfiltrates results as JSON, followed by hands-on-keyboard Active Directory and domain reconnaissance suggesting an interactive operator session. The malware establishes C2 over Cloudflare Tunnel (trycloudflare.com) subdomains with hardcoded fallback IPs for resilience, supports EXE/DLL download-and-execute, arbitrary command execution, registry Run-key persistence, and self-termination, and the actors were observed using RDP for lateral movement. In some cases the PHP variant subsequently deployed the original Node.js Interlock RAT.

Targeting appears opportunistic across a broad range of industries rather than sector-specific, reflecting continued tooling evolution by the Interlock group to improve resilience and evade detection. Researchers continue to monitor the cluster and plan further reporting.

title: PowerShell Execution via Run Dialog - Remote Content Download
description: Detects PowerShell invoked with command-line arguments to download and
  execute remote content (IEX, DownloadString, WebClient patterns), consistent with
  Run dialog-based malware delivery chains.
tags:
- attack.execution
- attack.t1059.001
- attack.t1204.001
- attack.t1189
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \powershell.exe
    CommandLine|contains:
    - IEX
    - DownloadString
    - WebClient
  filter_admin:
    User|contains:
    - SYSTEM
    - LOCAL SERVICE
  condition: selection and not filter_admin
falsepositives:
- Legitimate administrative scripts downloading remote content
- Software deployment and update tools using PowerShell and WebClient
level: high
id: a0c9e401-1915-5ee9-b4a1-54b082ec313d
status: experimental
author: Vorant

title: System Discovery Chain - Process/Network/Domain Enumeration
description: Detects rapid execution of discovery commands targeting process list,
  network configuration, ARP cache, privilege level, and domain groups - pattern consistent
  with automated post-execution reconnaissance.
tags:
- attack.discovery
- attack.t1082
- attack.t1049
- attack.t1057
- attack.t1069.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_process_discovery:
    CommandLine|contains:
    - Get-Process
    - tasklist
  selection_network_discovery:
    CommandLine|contains:
    - ipconfig
    - arp
    - netstat
  selection_privilege_discovery:
    CommandLine|contains:
    - whoami
    - net user
  selection_domain_discovery:
    CommandLine|contains:
    - net group
    - Get-ADGroup
    - net localgroup
  filter_admin:
    User|contains:
    - SYSTEM
  condition: (selection_process_discovery or selection_network_discovery or selection_privilege_discovery
    or selection_domain_discovery) and not filter_admin
falsepositives:
- System administration and monitoring tools collecting network/process telemetry
- IT troubleshooting scripts enumerating system state
level: medium
id: 024de6c7-349f-5c14-94dc-94d47879fa46
status: experimental
author: Vorant

title: Registry Run Key Modification for Persistence
description: Detects modification of HKCU or HKLM Run/RunOnce registry keys to register
  an executable for startup - typical persistence mechanism used by RATs and remote
  access malware.
tags:
- attack.persistence
- attack.t1547.001
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains:
    - \\Software\\Microsoft\\Windows\\CurrentVersion\\Run
    - \\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce
    Details|contains: \\
  filter_windows:
    Details|contains:
    - \\System32\\
    - \\Program Files\\
    - \\ProgramData\\Microsoft\\
  condition: selection and not filter_windows
falsepositives:
- Legitimate software installers and configuration tools adding startup entries
- System administration scripts managing user startup programs
level: high
id: 0a8761ae-6925-5c90-a800-6f8c7a3209a6
status: experimental
author: Vorant

Source reporting: https://thedfirreport.com/2025/07/14/kongtuke-filefix-leads-to-new-interlock-rat-variant