# Interlock ransomware group deploys new PHP RAT variant

Published: 2025-07-14 · Severity: high
Canonical: https://vorant.io/reports/d7ede32c-a315-5bd5-be83-3069e684a732/interlock-ransomware-group-deploys-new-php-rat-variant

> The Interlock ransomware group has shifted from JavaScript to a new PHP-based RAT variant, delivered via KongTuke web-inject campaigns targeting opportunistic victims across multiple sectors.

Researchers from The DFIR Report and Proofpoint have identified a new PHP-based variant of the Interlock ransomware group's remote access trojan, marking a significant evolution from the previously known JavaScript-based version (NodeSnake). Active since May 2025, the campaign leverages compromised websites injected with hidden scripts that employ IP filtering and social engineering tactics—including fake CAPTCHA prompts—to trick users into executing PowerShell commands that install the Interlock RAT.

The PHP variant exhibits sophisticated capabilities including automated system reconnaissance that exfiltrates comprehensive system profiles via PowerShell commands, Active Directory enumeration targeting backup infrastructure (specifically hunting for Veeam systems), and hands-on-keyboard interactive sessions. The malware establishes command-and-control communications through Cloudflare Tunnel services (trycloudflare.com) with hardcoded fallback IP addresses, and supports multiple execution methods including EXE, DLL, shell commands, and persistence mechanisms via Windows Registry Run keys. The threat actors have demonstrated lateral movement capabilities using RDP.

The campaign appears opportunistic rather than targeted, affecting organizations across multiple industries. The Interlock group's shift to PHP-based tooling demonstrates continued operational evolution and technical sophistication, with some infections deploying both PHP and Node.js RAT variants in sequence. The delivery mechanism has also evolved from earlier KongTuke web-inject campaigns to a newer FileFix variant, suggesting ongoing infrastructure and tradecraft refinement.

## Mentioned in this report

- Threat actors: LandUpdate808, interlock
- Malware: Interlock RAT, NodeSnake

## Detection guidance (public sample)

### Suspicious PowerShell Execution via Run Dialog (FileFix/ClickFix Pattern)

ATT&CK: T1059.001

Detects explorer.exe spawning powershell.exe with encoded or download-cradle command lines, consistent with FileFix/ClickFix social engineering used to deliver Interlock RAT via fake CAPTCHA prompts. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Suspicious PowerShell Execution via Run Dialog (FileFix/ClickFix Pattern)
id: 397aa570-1269-59cd-8420-a2fd67ec66b3
status: experimental
description: Detects PowerShell processes launched directly from explorer.exe with
  encoded commands or web download cradles, a pattern consistent with FileFix/ClickFix
  style social engineering used to deliver Interlock RAT.
references:
- https://www.proofpoint.com/
- https://thedfirreport.com/
author: Vorant
tags:
- attack.t1059.001
- attack.t1204.002
- attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: \explorer.exe
    Image|endswith:
    - \powershell.exe
    - \pwsh.exe
  selection_flags:
    CommandLine|contains:
    - -EncodedCommand
    - '-enc '
    - -nop
    - -w hidden
    - -windowstyle hidden
    - IEX
    - Invoke-Expression
    - DownloadString
    - 'iwr '
    - Invoke-WebRequest
  filter_common_admin:
    CommandLine|contains:
    - Set-ExecutionPolicy
    - Get-Help
  condition: selection_parent and selection_flags and not filter_common_admin
falsepositives:
- IT administrators launching PowerShell scripts from Start menu or Run dialog for
  legitimate automation
- Software deployment tools that briefly spawn PowerShell from explorer.exe context
  menus
level: high
```

### PowerShell-Based System and Active Directory Reconnaissance Chain

ATT&CK: T1069.002

Detects PowerShell command lines invoking multiple discovery commands (systeminfo, net group, nltest, tasklist, ipconfig) in a single execution, consistent with Interlock RAT's automated reconnaissance targeting AD groups and backup infrastructure like Veeam. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: PowerShell-Based System and Active Directory Reconnaissance Chain
id: 6ece9f99-194d-517f-987a-539c27e88e96
status: experimental
description: Detects PowerShell command lines that chain multiple discovery utilities
  (systeminfo, net group /domain, nltest, tasklist, ipconfig) often referencing Veeam,
  consistent with Interlock RAT automated reconnaissance behaviour.
references:
- https://www.proofpoint.com/
- https://thedfirreport.com/
author: Vorant
tags:
- attack.t1069.002
- attack.t1082
- attack.t1016
- attack.t1057
- attack.t1087.002
- attack.t1018
- attack.t1007
- attack.discovery
logsource:
  category: process_creation
  product: windows
detection:
  selection_powershell:
    Image|endswith:
    - \powershell.exe
    - \pwsh.exe
  selection_discovery_terms:
    CommandLine|contains|all:
    - systeminfo
  selection_ad_terms:
    CommandLine|contains:
    - net group
    - nltest
    - /domain
    - Get-ADGroup
    - Get-ADComputer
  selection_veeam:
    CommandLine|contains:
    - Veeam
  condition: selection_powershell and (selection_discovery_terms or selection_ad_terms
    or selection_veeam)
falsepositives:
- Legitimate IT asset inventory or health-check scripts that query system and domain
  information
- Backup administrators running Veeam infrastructure audit scripts via PowerShell
level: medium
```

### Registry Run Key Persistence via Reg or PowerShell for RAT Startup

ATT&CK: T1547.001

Detects creation of Run/RunOnce registry values via reg.exe or PowerShell referencing script interpreters or unusual executable paths, consistent with Interlock RAT persistence mechanism. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Registry Run Key Persistence via Reg or PowerShell for RAT Startup
id: 937f1958-28e3-5a4b-81ff-4153a6e38b85
status: experimental
description: Detects creation or modification of Run/RunOnce registry keys using reg.exe
  or PowerShell New-ItemProperty, pointing to script interpreters (wscript, cscript,
  powershell, mshta) or executables outside standard Program Files paths, consistent
  with Interlock RAT establishing persistence.
references:
- https://www.proofpoint.com/
- https://thedfirreport.com/
author: Vorant
tags:
- attack.t1547.001
- attack.persistence
logsource:
  category: registry_set
  product: windows
detection:
  selection_runkey:
    TargetObject|contains:
    - \Software\Microsoft\Windows\CurrentVersion\Run\
    - \Software\Microsoft\Windows\CurrentVersion\RunOnce\
  selection_suspicious_value:
    Details|contains:
    - powershell
    - pwsh
    - wscript
    - cscript
    - mshta
    - .php
    - AppData\Roaming
    - AppData\Local\Temp
  condition: selection_runkey and selection_suspicious_value
falsepositives:
- Legitimate software installers registering update-checker scripts under Run keys
- IT-managed login scripts stored in AppData referenced from Run keys
level: medium
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://thedfirreport.com/2025/07/14/kongtuke-filefix-leads-to-new-interlock-rat-variant

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/d7ede32c-a315-5bd5-be83-3069e684a732/interlock-ransomware-group-deploys-new-php-rat-variant.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup