Interlock Ransomware Profile Guide: Fake updates, ClickFix and how to stop them

Interlock is a double extortion ransomware operation that gets in through the web browser, not the perimeter, so the controls most organisations lean on for ransomware (VPN MFA, patching edge devices) do little to stop its first stage. First observed in late September 2024, it was the subject of a joint #StopRansomware advisory (AA25-203A) from the FBI, CISA, HHS and MS-ISAC in July 2025, and it has been linked by reporting to disruptive attacks on US healthcare providers and a city government. This profile covers who the group is, how it moves from a compromised website to encrypted virtual machines, where credentials and identities are abused along the way, and what defenders should detect and harden. It is for SOC analysts, threat hunters, incident responders and the IT teams who own endpoints, Active Directory and Azure storage. For the wider landscape of groups, see the Ransomware Groups Guide.

Key takeaways

• Initial access is a user action in a browser. AA25-203A describes drive-by downloads from compromised legitimate sites, fake Chrome, Edge and VPN client updates, and ClickFix fake CAPTCHA pages that get the user to paste and run PowerShell.
• Credentials are harvested early. A custom browser credential stealer (cht.exe), a keylogger (klg.dll) and commodity stealers such as Lumma and Berserk feed the later RDP, Kerberoasting and domain admin stages.
• Exfiltration rides on Azure tooling. Azure Storage Explorer and AzCopy upload stolen data to attacker controlled Azure blob storage, so the traffic goes to a trusted cloud domain, not an obscure server.
• Encryption targets Windows, Linux and VMs. The advisory lists Windows and Linux encryptors seen encrypting virtual machines, files renamed to .interlock or .1nt3rlock, and a ransom note (!__README__!.txt) pushed through Group Policy.
• Defence is mostly basic hygiene done well. Script block logging, controls on the Run dialog and PowerShell for ordinary users, RC4 removal for service accounts, blocking unapproved remote access tools and immutable backups break most of the chain.

Who they are (names and aliases)

Interlock is tracked under its own name. It is not an entry in MITRE ATT&CK v20 as a group or software (checked against the official dataset), so mappings on this page come from the advisory and from incident reports. Unlike most current groups it is not widely described as a ransomware-as-a-service (RaaS) brand with recruited affiliates: the advisory describes "Interlock actors" running the full intrusion. See the Ransomware-as-a-Service Business Model Guide for how that differs from affiliate models.

Treat the Rhysida link as a hypothesis, not a fact. It matters practically because Rhysida detections (see the Rhysida Ransomware Profile Guide) overlap with Interlock behaviour, but hunting should not assume one group. The Ransomware Lineage and Rebrands Guide explains why lineage claims need care.

Targeting and motivation

The motive is financial. AA25-203A says the group targets businesses and critical infrastructure in North America and Europe, and Talos described victims as opportunistic across healthcare, technology, US government and European manufacturing. HHS co-sealed the advisory and asked healthcare organisations to apply the HPH sector cybersecurity performance goals, which reflects how often health systems appear among reported victims.

• Healthcare: clinical disruption creates pressure to pay, and patient records give leak threats weight.

Tactics and techniques (MITRE ATT&CK)

The intrusion chain in public reporting runs: compromised website, fake update or ClickFix lure, remote access trojan (RAT), credential theft, RDP and remote access tools, domain privilege, Azure exfiltration, then encryption. Talos measured about 17 days from initial compromise to ransomware deployment in the incident it investigated, which is the window defenders have to break the chain.

IDs verified against ATT&CK v20. Talos also saw attempts to disable EDR and clear event logs; the EDR Evasion and Defence Guide covers the defensive side.

The lure evolution

• 2024: a fake Chrome updater (upd_2327991.exe, per Talos) served from a compromised news site, which also ran the genuine ChromeSetup.exe so the user saw a normal install.
• 2025: filenames posing as VPN and security clients (FortiClient.exe, GlobalProtect.exe, Cisco-Secure-Client.exe), then ClickFix pages. The DFIR Report described the KongTuke (LandUpdate808) web inject filtering visitors by IP before showing a "Verify you are human" prompt, with a PHP variant of the RAT first seen in June 2025 according to Proofpoint.

The common thread is that the user starts the code. See the ClickFix and Fake CAPTCHA Paste-and-Run Attacks Guide and the Drive-by Downloads Guide.

How they abuse identities and credentials

Interlock is an identity story once it is past the first host. The RAT gives a foothold as the logged-in user; everything after that depends on stolen secrets.

• Browser saved credentials: cht.exe copies browser login databases and extracts usernames, passwords and URLs, which can include SaaS, VPN and admin portal logins. Stealers such as Lumma also take session cookies. See the Lumma Stealer Guide and the Infostealer Logs and Session Token Abuse Guide.
• Keystrokes: klg.dll logs typed credentials, which defeats "do not save passwords in the browser" policies on its own.
• Service accounts via Kerberoasting: any domain user can request service tickets for accounts with a service principal name; weak passwords on those service accounts can be cracked offline. Talos and the advisory both cite this as a likely route to domain admin. See the Kerberos Security Guide and the Service Account Security Guide.
• Remote access tools as identities: AnyDesk and ScreenConnect installs create their own persistent access path that does not depend on AD passwords. See the RMM Tool Security Guide.
• Cloud storage credentials: AzCopy uploads need a shared access signature (SAS) or credential for the attacker's storage account. The victim's own Azure identities are not required, which is why egress to *.blob.core.windows.net from servers that never use Azure is a useful signal.

Notable incidents

The incidents below are attributed through the group's leak site claims and press reporting, and the victims had not confirmed attribution at the time of the cited reports.

All three involved weeks of disruption, so recovery planning matters as much as prevention. See the Ransomware Response and Recovery Guide.

Detection and defence

What to log and hunt

Prevention and hardening

• Break the paste-and-run step: remove the Run dialog for standard users where the business allows (the "Remove Run menu from Start Menu" policy), restrict PowerShell with Constrained Language Mode through application control, and teach users that no website ever asks them to paste commands. See the PowerShell Security Guide.
• Control what runs from user profiles: application control rules that block unsigned executables and interpreters (php.exe, node.exe) in AppData stop the RAT variants. See the Application Allowlisting Guide.
• Software updates come from management, not the browser: block downloads of executables named as browser or VPN updaters through the web proxy and DNS filtering (an AA25-203A mitigation).
• Harden service accounts against Kerberoasting: long random passwords or group managed service accounts, AES only encryption types, and removal of unnecessary SPNs.
• Allowlist remote access tools: block AnyDesk, ScreenConnect and similar tools except the approved instance. The Unauthorised Remote Monitoring and Management Tool Playbook covers the response.
• Restrict RDP: require MFA or a gateway for admin RDP, and block workstation to workstation RDP. See the Remote Desktop (RDP) Security Guide.
• Protect recovery: offline, segmented, encrypted and immutable backups that are tested, as the advisory recommends, plus EDR on hypervisors and VMs. See the Backup Security and Immutable Backup Guide.

Measuring it

• Script block logging coverage: percentage of Windows endpoints sending 4104 events to the SIEM (target 100%).
• Kerberoastable accounts: count of user accounts with SPNs and RC4 enabled (target falling to zero).
• Unapproved remote access tools: endpoints with AnyDesk, ScreenConnect or similar outside the approved list (target zero).
• Time to contain a ClickFix alert: from alert to host isolation, measured in exercises (aim well under a day given a 17 day attack window).

If you find Interlock activity

1. Isolate the first host and preserve memory and disk before reimaging; capture browser profile folders to know which credentials were exposed.
2. Reset every credential stored in that browser and revoke the user's sessions in the identity provider and SaaS apps.
3. Hunt for the RAT persistence keys, trycloudflare.com traffic and remote access tool installs on other hosts.
4. Rotate passwords on service accounts with SPNs, then the krbtgt account twice if domain admin compromise is suspected, following your identity recovery plan.
5. Check Azure, proxy and firewall logs for AzCopy uploads to estimate data theft for notification decisions.
6. Report to CISA or the FBI (IC3) as the advisory asks, and engage legal counsel before any contact with the actors. See the Ransomware Payments and Sanctions Guide.

Framework mapping

Common failure patterns

• Treating browser lures as a phishing problem only. Email filtering does nothing when the lure is a compromised site the user chose to visit; web and endpoint controls carry the load.
• Kerberoastable service accounts with old passwords. Service accounts set up years ago with RC4 and short passwords are the shortcut from user to domain admin.
• Remote access tools without an allowlist. If any user can install AnyDesk, the attacker's persistence looks like IT support.
• Backups reachable from the domain. The DFIR Report saw searches for backup related computer names; backups joined to the same AD fall with it.

Practitioner checklist

• Enable PowerShell script block logging (4104) on all Windows endpoints and forward it to the SIEM.
• Restrict the Run dialog and interactive PowerShell for standard users where feasible, and brief users on ClickFix lures.
• Block execution of unsigned binaries and script interpreters from AppData and Downloads.
• Find every account with an SPN, move to gMSA or long random passwords, and disable RC4.
• Block unapproved remote access tools and alert on new installs.
• Alert on AzCopy, Storage Explorer and WinSCP on servers and on bulk uploads to blob storage.
• Keep immutable, offline backups outside the production domain and test restores.
• Load the AA25-203A STIX indicators into detection tooling, vetting legitimate tool hashes first.

Standards and references

• CISA, FBI, HHS and MS-ISAC: #StopRansomware: Interlock (AA25-203A)
• CISA and FBI: #StopRansomware: Rhysida Ransomware (AA23-319A)
• Cisco Talos: Emerging Interlock ransomware analysis
• The DFIR Report: KongTuke FileFix Leads to New Interlock RAT Variant
• Microsoft Learn: about_Logging_Windows
• MITRE ATT&CK: Malicious Copy and Paste (T1204.004)
• MITRE ATT&CK: Kerberoasting (T1558.003)
• NIST: SP 800-53 Rev. 5

Related NHI Mgmt Group resources: Ransomware Groups Guide · Rhysida Ransomware Profile Guide · ClickFix and Fake CAPTCHA Paste-and-Run Attacks Guide · Ransomware Prevention Guide · Healthcare Identity Security Guide