Interlock ransomware debuts PHP RAT via FileFix
Interlock ransomware group is using a new PHP-based RAT delivered through KongTuke/LandUpdate808 fake-CAPTCHA web injects and Cloudflare Tunnels for C2.
Sourcethedfirreport.com — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
The DFIR Report, working with Proofpoint, identified a new PHP variant of the Interlock ransomware group's RAT, a departure from the group's earlier Node.js-based Interlock RAT (NodeSnake). The infection chain begins with compromised legitimate websites injected with a hidden single-line script tied to the LandUpdate808/KongTuke web-inject cluster. Victims are lured through a fake "Verify you are human" CAPTCHA and 'FileFix' verification steps that trick them into pasting and executing a malicious PowerShell command via the Windows Run dialog, which retrieves and launches PHP configured to load the RAT payload.
Once executed, the PHP-based Interlock RAT performs extensive automated discovery (system info, running processes/services, mounted drives, ARP neighbors, privilege level) and exfiltrates results as JSON, followed by hands-on-keyboard Active Directory and domain reconnaissance suggesting an interactive operator session. The malware establishes C2 over Cloudflare Tunnel (trycloudflare.com) subdomains with hardcoded fallback IPs for resilience, supports EXE/DLL download-and-execute, arbitrary command execution, registry Run-key persistence, and self-termination, and the actors were observed using RDP for lateral movement. In some cases the PHP variant subsequently deployed the original Node.js Interlock RAT.
Targeting appears opportunistic across a broad range of industries rather than sector-specific, reflecting continued tooling evolution by the Interlock group to improve resilience and evade detection. Researchers continue to monitor the cluster and plan further reporting.
Mentioned in this report
Detection guidance
PowerShell Execution via Run Dialog - Remote Content Download
A behavioural hunt for the technique in general.
PowerShell spawned to download and execute remote PHP/executable content, typical of drive-by compromise infection chains using Run dialog delivery. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: PowerShell Execution via Run Dialog - Remote Content Download
description: Detects PowerShell invoked with command-line arguments to download and
execute remote content (IEX, DownloadString, WebClient patterns), consistent with
Run dialog-based malware delivery chains.
tags:
- attack.execution
- attack.t1059.001
- attack.t1204.001
- attack.t1189
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: \powershell.exe
CommandLine|contains:
- IEX
- DownloadString
- WebClient
filter_admin:
User|contains:
- SYSTEM
- LOCAL SERVICE
condition: selection and not filter_admin
falsepositives:
- Legitimate administrative scripts downloading remote content
- Software deployment and update tools using PowerShell and WebClient
level: high
id: a0c9e401-1915-5ee9-b4a1-54b082ec313d
status: experimental
author: Vorant
Registry Run Key Modification for Persistence
A behavioural hunt for the technique in general.
Modification of Windows Registry Run or RunOnce keys to persist executable, common RAT persistence mechanism observed in Interlock campaigns. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Registry Run Key Modification for Persistence
description: Detects modification of HKCU or HKLM Run/RunOnce registry keys to register
an executable for startup - typical persistence mechanism used by RATs and remote
access malware.
tags:
- attack.persistence
- attack.t1547.001
logsource:
category: registry_set
product: windows
detection:
selection:
TargetObject|contains:
- \\Software\\Microsoft\\Windows\\CurrentVersion\\Run
- \\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce
Details|contains: \\
filter_windows:
Details|contains:
- \\System32\\
- \\Program Files\\
- \\ProgramData\\Microsoft\\
condition: selection and not filter_windows
falsepositives:
- Legitimate software installers and configuration tools adding startup entries
- System administration scripts managing user startup programs
level: high
id: 0a8761ae-6925-5c90-a800-6f8c7a3209a6
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://thedfirreport.com/2025/07/14/kongtuke-filefix-leads-to-new-interlock-rat-variant
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the actors, malware, and campaigns it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs