Assessment at a glance

Identity: Interlock is a ransomware and extortion operation first observed in late September 2024, according to the joint FBI, CISA, HHS and MS-ISAC advisory AA25-203A of 22 July 2025. Sophos tracks the operators as GOLD EMBRACE (Sophos incident report) and IBM X-Force as Hive0163 (IBM X-Force). No numbered APT designation and no CrowdStrike or Microsoft alias appears in the retained sources, and this profile does not invent one. Model: Talos calls Interlock a closed group; IBM says it does not appear to operate as a RaaS; FortiGuard and Sophos describe a small dedicated team that develops its own malware. IBM's own evidence limits that picture, as set out below. Motivation: financial, double extortion. Research checked: 9 November 2026, with publication dates and the dates of underlying activity kept separate. Evidence base: two full incident-response cases (FortiGuard, January 2026; Sophos, August 2026), one X-Force engagement (March 2026), Amazon's honeypot campaign, IBM's staging-server analysis and Talos's aggregate Q3 observations. Confidence: high in the case-specific findings; moderate in generalisations, because that set is not a census.

Current assessment, 9 November 2026

Two things changed in 2026. Interlock added exploitation of an internet-facing security management appliance to a repertoire that had been user-assisted: drive-by downloads, ClickFix and trojanised installers. And the three 2026 investigations show what follows entry: months of latent access, memory-based credential theft, mass account creation, hypervisor encryption, a likely AI-generated backdoor, and a victim that lacked the backups it believed it had. Recovery therefore turns on identity, hypervisor and backup verification, not on the encryptor.

The freshest actor-specific evidence is Cisco Talos's Q3 2026 incident-response report of 29 October. Beyond listing Interlock among the ransomware it encountered, Talos describes Interlock actors making repeated attempts to impair endpoint detection: trying to uninstall Cisco Secure Endpoint, using PsExec and taskkill to stop security services and integrity checkers including cscm.exe and sfc.exe, disabling Windows Defender real-time protection and clearing event logs. Talos adds that this matches earlier Interlock activity in which a malicious Windows Defender Application Control (WDAC) policy was deployed to terminate EDR, and it distinguishes Interlock, which "operates as a closed group", from the RaaS brands in the same quarter. The report's quarter-wide figures on vishing, edge-device exploitation and the 27 per cent ransomware share describe Talos's whole caseload, not Interlock. Talos Q3 2026

Sophos's 4 August 2026 publication covers an Emergency Incident Response case from March 2026 in which Interlock used the forensic tools Volatility3 and WinPmem to extract credentials from memory on the first compromised endpoint, reached the domain controller a little over 26 hours after a ClickFix lure, and later added domain-administrator accounts, dumped credentials including AWS keys, tampered with Defender, exfiltrated data and locked the customer out of its hypervisors. Sophos says the customer believed it had backups and did not, and lacked up-to-date network documentation and a complete asset inventory. Sophos incident report

Operations timeline

Date Event Source
Late September 2024 Interlock first observed; drive-by and ClickFix entry; Windows and Linux encryptors AA25-203A
31 March 2025 MintLoader infection on a laptop without EDR at a North American education organisation; NodeSnakeRAT persisted by a "ChromeUpdater" autorun FortiGuard IR
3 and 21 April 2025 Brief RDP session with a dormant default Administrator account; InterlockRAT deployed; then months without significant activity FortiGuard IR
4 to 15 September 2025 Infrastructure rotated; implant on an application server; ScreenConnect installed; AzCopy used to exfiltrate more than 250 GB FortiGuard IR
8 to 12 October 2025 Hotta Killer deployed (8 October); Nutanix disks encrypted over SSH; domain-wide Windows deployment with PsExec; about 5,000 domain accounts created FortiGuard IR
28 October 2025 CVE-2025-61155, the anti-cheat driver flaw Hotta Killer abuses, published EUVD-2025-36537
26 January 2026 Earliest honeypot activity Amazon links to CVE-2026-20131 Amazon
Early 2026 X-Force engagement: ClickFix, NodeSnake, InterlockRAT, the Slopoly backdoor and Interlock ransomware IBM Slopoly
4 March 2026 Cisco advisory cisco-sa-fmc-rce-NKhnULJh version 1.0 Cisco PSIRT
March 2026 Sophos EIR case: ClickFix on a compromised site reached from a ChatGPT search Sophos incident report
12 and 18 March 2026 IBM publishes the Slopoly engagement; Amazon publishes; Cisco version 1.1 records awareness of attempted exploitation IBM Slopoly, Amazon, Cisco PSIRT
19 March 2026 Exploited-since date carried by the European registry record EUVD-2026-9444
25 March 2026 Cisco version 1.2: fix deployed to Security Cloud Control Firewall Management Cisco PSIRT
4 August 2026 Sophos publishes the March case Sophos incident report
29 October 2026 Talos Q3 2026 report names Interlock and its EDR-impairment attempts Talos Q3 2026

Targeting and victimology

Every source reports from its own vantage point, and the leak-site figures are claims, not verified incidents. The joint advisory describes opportunistic, financially motivated targeting of business, critical infrastructure and other organisations in North America and Europe (AA25-203A). Sophos says the group has been seen worldwide but currently concentrates on North American and European critical infrastructure, healthcare and education, and threatens to leak stolen data on its "Worldwide Secrets Blog" if its demands are not met (Sophos incident report). FortiGuard sees a focus on UK and US organisations, particularly education (FortiGuard IR). Amazon ranks education first, then engineering, architecture and construction, manufacturing and industrial, healthcare, and government, without published counts; it also infers from timestamps, with 75 to 80 per cent confidence, that the operators most likely work in UTC+3, which is a working-hours fit and not a location or attribution finding (Amazon). IBM counts around 80 leak-site claims for Interlock in 2025, mostly in the United States (IBM X-Force). Treat the sector ranking as indicative: opportunistic selection can still produce a skewed victim population.

CVE-2026-20131: vendor record, registry record and the exploitation clocks

Cisco's advisory, version 1.2 of 25 March 2026, describes insecure deserialisation of a user-supplied Java byte stream in the web-based management interface of Secure Firewall Management Center (FMC) Software, letting an unauthenticated remote attacker execute arbitrary Java code as root. It affects Secure FMC Software and Cisco Security Cloud Control (SCC) Firewall Management regardless of device configuration; Secure Firewall ASA and FTD Software are not affected. There are no workarounds. Cisco does not list fixed releases in the advisory text and directs customers to the Cisco Software Checker for the first fixed release. SCC Firewall Management is a SaaS offering that Cisco upgrades itself: version 1.2 states that the fix has been deployed to SCC environments and no user action is required. Version 1.1 of 18 March states that PSIRT became aware of attempted exploitation in March 2026, and the advisory links Snort rules 66082 and 66083.

The European Vulnerability Database record EUVD-2026-9444 lists CVE-2026-20131 and GHSA-r229-mj76-g2qx as aliases, carries the CVSS 3.1 base score of 10.0, enumerates 70 affected FMC release entries from 6.4.0.13 through the 7.x trains to 10.0.0, and was last updated on 14 August 2026. Its exploited-since date of 19 March 2026 matches the CISA KEV addition described in our March article. The registry describes the vulnerability; it does not attribute any campaign.

Four clocks are in circulation, and none is a victim dwell time:

Clock What it measures Source
26 January to 4 March 2026 Amazon's MadPot honeypots saw activity it first calls "potentially related" to the CVE from 26 January; its headline says Interlock exploited the flaw 36 days before disclosure. A calendar count gives 37 days, and the same paragraph speaks of "a week's head start" without reconciling the figures Amazon
"a full two weeks before Cisco acknowledged it" Sophos's summary of its own evidence. It does not say whether the reference point is Cisco's 4 March advisory or the 18 March exploitation note, so the figure cannot be reconciled with Amazon's Sophos incident report
March 2026 The vendor's own statement: awareness of attempted exploitation. Cisco does not confirm the January date Cisco PSIRT
8 October 2025, twenty days before 28 October 2025 A second pre-disclosure exploitation: FortiGuard dates the Hotta Killer tool to 8 October 2025 and calls the driver flaw a zero-day; the registry record for CVE-2025-61155 was published on 28 October 2025 FortiGuard IR, EUVD-2025-36537

Amazon attributes the recovered ELF binary and staging artefacts to Interlock on the ransom note and Tor portal branding, the note's invocation of data protection regulations and a per-victim organisation identifier, and it lists the same TLS JA3 and JA4 fingerprints and user agent in January and March. TIR assessment: that supports attribution of Amazon's observed campaign to Interlock. It does not make every probe against CVE-2026-20131 an Interlock intrusion, and a defender whose FMC was internet-reachable at any point since 26 January should scope from artefacts and infrastructure, not from the CVE alone.

How Interlock gets in

Route Evidence Source
Drive-by download from compromised legitimate sites, with fake Chrome or Edge updates; a cybersecurity company cited by the advisory later saw fake security-software updates FBI observations; described as uncommon among ransomware groups AA25-203A
ClickFix: the user pastes a command into the Run dialog FBI observations; the Sophos case began with a ClickFix lure on a reputable site reached from a ChatGPT search; the X-Force Slopoly case began the same way AA25-203A, Sophos incident report, IBM Slopoly
Trojanised installers and the MintLoader chain served through a traffic-distribution system FortiGuard assessed its case's entry as a MintLoader infection; IBM links Interlock infections consistently to the KongTuke or LandUpdate808 cluster and to signed JunkFiction downloaders, and says Hive0163 reportedly also relies on initial access brokers such as TA569 (SocGholish) FortiGuard IR, IBM X-Force, IBM Slopoly
Exploitation of Cisco FMC CVE-2026-20131 Honeypot campaign; exploit requests carried Java execution attempts and a confirmation step that made the target issue an HTTP PUT Amazon

These are observed routes in particular cases, not prerequisites. The FortiGuard case began on a laptop with no EDR; in the Sophos case the first machine was a Defender-managed Windows 10 endpoint in an estate of Sophos-managed servers and Defender-managed endpoints, and Sophos found that some other endpoints ran no protection at all.

Inside the network: what the 2025 and 2026 cases show

Latency, then speed. In the FortiGuard case, the March 2025 infection sat on a laptop that was rarely connected to the corporate network, and the operators did nothing significant for months. They rotated infrastructure on 4 September, appeared on an application server on 5 September, installed ScreenConnect from an MSI named support.msi on 13 September, browsed file servers interactively, and on 15 September copied AzCopy to the primary file server and exfiltrated more than 250 GB. There was then a gap of weeks before encryption. FortiGuard notes that indicators for this activity had been public for over four months before impact. In the Sophos case the tempo was the opposite: a Run key within 26 minutes, an LDAP survey and a Kerberoasting-style SPN query on day two, lateral movement to a domain controller at about 26 hours using anonymous login and an NTLM downgrade, a 24-hour pause, and on day three a scheduled task on a print server, named \Microsoft\Windows\Defrag\ScheduledDefrags, running the persistence payload through node.exe under a compromised domain-administrator account. The same task name appears in the FortiGuard case.

A likely AI-generated backdoor, used late. In an early-2026 engagement, X-Force found a PowerShell script it names Slopoly: the client of a novel C2 framework that beacons system data to an "/api/commands" endpoint every 30 seconds, polls for commands every 50 seconds, runs them through cmd.exe and keeps a rolling persistence.log. Its extensive comments, logging, error handling, well-named variables and an unused jitter function led X-Force to assess it as probably LLM-generated by a less advanced model, with any guardrails circumvented. The builder placed it under C:\ProgramData\Microsoft\Windows\Runtime\ with a scheduled task named "Runtime Broker", and Hive0163 used it to keep access to the infected server for more than a week, alongside other backdoors and late in the intrusion, which X-Force reads as a live-fire test; the commands run could not be recovered. The chain was ClickFix, NodeSnake, InterlockRAT, then Slopoly, AzCopy and Advanced IP Scanner. IBM notes that the framework's clients have been widely reported as InterlockRAT but that the final payloads may not be limited to Interlock. The Windows encryptor found there is a 64-bit PE packed with the JunkFiction loader that encrypts with AES-GCM under per-file session keys wrapped with RSA, using a statically linked OpenSSL 3.5.0; its -s option creates, runs and then deletes a daily scheduled task named "TaskSystem"; it appends .!NT3RLOCK, .int3R1Ock or a similar extension, leaves a note named FIRST_READ_ME.txt or similar in each directory, and with -del drops tmp.wasd into the user's temporary folder and runs it through rundll32 to remove itself, the same DLL used by Supper and the JunkFiction downloader. IBM Slopoly

Credential theft from memory and from caches. Sophos observed Volatility3 hashdump and cachedump commands against a memory image captured with WinPmem on the first compromised machine, followed by dumping that included AWS credentials. IBM found WinPmem and Volatility, the NTLMThief harvester, a Group Policy Preferences password script, a Chrome app-bound-encryption decryptor, an MSSQL enumeration tool and an NTP timeroasting script on Interlock staging servers, alongside a fake-Windows-update credential prompt built on CredPhish that had one target's domain and username hard-coded. FortiGuard observed a custom browser-credential stealer and the GPPPassword script. Sophos incident report, IBM X-Force, FortiGuard IR

Privilege escalation tooling. IBM lists a PrintNightmare exploit and a JunkFiction-crypted local privilege-escalation exploit for CVE-2023-36036 on the staging servers, and Amazon lists Certify for abusing Active Directory Certificate Services. The joint advisory says domain-administrator accounts were compromised, possibly by Kerberoasting; Sophos observed the SPN query that such an attack requires. IBM X-Force, Amazon, AA25-203A

Three ways of impairing EDR, from three kinds of evidence. Talos observed uninstall attempts, PsExec and taskkill against security services, Defender tampering and log clearing in Q3 2026, and says earlier Interlock activity deployed a malicious WDAC policy to terminate EDR. IBM found, on a staging server, a ZIP containing a custom WDAC policy and certificate whose rules allow node.exe, javaw.exe, PowerShell, RefreshPolicy.exe, Dropbox and Google Drive installers, Firefox, Chrome and JunkFiction-style file attributes, and deny SmartScreen, Microsoft Defender and Sophos EDR components; IBM found the artefact and does not describe a deployment. FortiGuard watched the bring-your-own-vulnerable-driver tool it calls Hotta Killer: polers.dll run through rundll32 with the argument "start Forti*", dropping a signed kernel driver renamed UpdateCheckerX64.sys, originally GameDriverX64.sys, registered as a kernel-driver service named UpdateCheckerX64_ followed by random digits so that it appears in the registry rather than the Services list, and kept alive by a PowerShell loop holding five instances. FortiGuard calls it an elevated process killer rather than an EDR bypass, and says it did not affect the installed Fortinet software. The driver flaw is EUVD-2025-36537, alias CVE-2025-61155 and GHSA-9qfv-m6w2-fhch: an IOCTL access-control flaw in GameDriverX64.sys version 7.23.4.7 and earlier that lets a low-privileged local process terminate arbitrary processes, scored CVSS 3.1 5.5, published 28 October 2025, with no fixed version recorded. Talos Q3 2026, IBM X-Force, FortiGuard IR

Impact beyond virtual machines. The July 2025 advisory said that, to date, Interlock had encrypted VMs while leaving hosts, workstations and physical servers unaffected, and warned that this could change. It has. In October 2025 the FortiGuard operators used SSH and an existing administrator account to reach a Nutanix system, encrypted its logical disks with an ELF binary appending .!nt3rlock, verified the result in Prism Central, and then deployed a JavaScript encryptor run through a dropped javaw.exe across the Windows domain with PsExec and domain-administrator credentials; that variant appended .gif. Afterwards they created about 5,000 domain accounts matching the victim's naming convention, for a purpose FortiGuard could not establish. The Sophos customer was locked out of its hypervisors. Encryptors exist for Windows, Linux and, per researchers cited by the advisory, FreeBSD; Sophos also reports a PHP backdoor for cross-platform persistence, and IBM documents NodeSnake builds in PHP for Windows and Linux. AA25-203A, FortiGuard IR, Sophos incident report, IBM X-Force

The appliance toolkit. Amazon's recovered set is detailed in our March article: a per-host PowerShell enumeration script, JavaScript and Java WebSocket RATs with SOCKS5 proxying, log-wiping HAProxy relays, the memory-resident Java webshell, a TCP beacon on port 45588, ScreenConnect, Volatility and Certify. IBM analysed two staging servers, 172.86.68[.]175 and 37.27.244[.]222, the second being the host Amazon reported, and gives one combined tool list across both that adds Sliver and SystemBC; the two vendors corroborate the IP, not a per-server inventory. Amazon, IBM X-Force

ATT&CK mapping

Mapped only to behaviour reported in the sections above, which carry the source for each; the advisory's own mapping uses ATT&CK version 17.

Technique Reported behaviour
T1189 Drive-by Compromise; T1204 User Execution Compromised sites with fake updates; ClickFix (advisory, Sophos, IBM)
T1190 Exploit Public-Facing Application CVE-2026-20131 requests to the FMC management interface (Amazon)
T1547.001 Run Keys / Startup Folder; T1053.005 Scheduled Task "Chrome Updater" run key and "ChromeUpdater" autorun; ScheduledDefrags and TimeSync task names; Slopoly's and the encryptor's task options (advisory, FortiGuard, Sophos, IBM)
T1505.003 Web Shell Memory-resident ServletRequestListener on FMC (Amazon)
T1003 OS Credential Dumping; T1558.003 Kerberoasting Volatility3 hashdump and cachedump on a WinPmem image; SPN query; NTLMThief (Sophos, IBM)
T1562.001 Impair Defenses; T1211 Exploitation for Defense Evasion EDR uninstall and taskkill; WDAC policy; Hotta Killer with CVE-2025-61155 (Talos, IBM, FortiGuard)
T1219 Remote Access Tools; T1021.001 RDP ScreenConnect from support.msi; AnyDesk; RDP with valid accounts (FortiGuard, advisory)
T1567.002 Exfiltration to Cloud Storage AzCopy and Azure Storage Explorer; more than 250 GB in one case (advisory, FortiGuard)
T1486 Data Encrypted for Impact; T1136.002 Create Domain Account Nutanix and Windows encryption; about 5,000 accounts created after deployment (FortiGuard)
T1070 Indicator Removal Self-deleting encryptor DLL; log clearing; relay cron truncating logs (advisory, Talos, Amazon)

Malware relationships and the Rhysida question

IBM X-Force's 12 June 2026 research is the most specific public account. It describes NodeSnake, first identified in January 2025 and tracked by Google as CORNFLAKE, as a downloader-backdoor that hands off to InterlockRAT, a fuller backdoor with reverse shell and SOCKS5 tunnelling; the two share code and command-and-control servers. Supper, also known as SocksShell, is "effectively just a different implementation of InterlockRAT", and the JunkFiction downloader shares code and infrastructure with NodeSnake. Supper predates both and has been seen in Rhysida incidents as well as Interlock ones, crypted with each group's preferred crypter: JunkFiction for Interlock, Tomb for the Vanilla Tempest operators associated with Rhysida, who also use the Endico downloader and Broomstick. IBM assesses InterlockRAT as likely exclusive to Interlock. IBM X-Force

The competing hypothesis is older. IBM quotes an earlier Cisco Talos assessment, undated in IBM's text and made with low confidence, that "Interlock ransomware is likely a new diversified group that emerged from Rhysida ransomware operators or developers", on TTP and encryptor similarities. IBM's own conclusion after two years is a "relationship or lineage" between Interlock and Rhysida actors whose exact nature remains unknown, with similar but distinct access campaigns, downloaders, backdoors and crypters. The joint advisory records only emerging open-source reporting of similarities between the two ransomware variants. IBM X-Force, AA25-203A

Two IBM findings also limit the "closed group" label. NodeSnake's C2 registration carries a vendor ID, of which IBM has seen two values, 0x0 and 0x2b, and IBM says the framework might therefore be used with different affiliates; and a slightly larger group of operators than Interlock has access to Supper. IBM's March 2026 report describes Hive0163 not as a silo but as several dynamic subclusters sharing private crypters, malware frameworks and ransomware variants, with suspected ties to former ITG23 crypter developers. IBM X-Force, IBM Slopoly

TIR assessment: the shared-code evidence supports a common developer or supplier hypothesis for the backdoor family, and Talos's origin hypothesis remains possible but unproven: IBM's two years of observation leave the relationship's nature unknown. Neither supports treating Interlock and Rhysida as one operator: Rhysida is a service with affiliates and a named operator cluster, no affiliate programme is reported for Interlock, and their crypters, downloaders and encryptors differ. "Closed" describes the absence of a public affiliate programme, not proof of a single team. An Interlock encryptor identifies an Interlock intrusion; a Supper or NodeSnake detection on its own does not identify which operators are behind it. IBM also reports code overlaps between NodeSnake and ModeloRAT, a backdoor distributed by KongTuke, and a CVE-2023-36036 exploit in a ModeloRAT intrusion highly similar to the implementation on an Interlock staging server: shared tooling across the traffic-distribution cluster and the ransomware operation, not common command. See the Rhysida profile for the service, Vanilla Tempest and Fox Tempest distinctions; this profile does not repeat them.

Persistence and dwell-time limits

Mechanism Where observed Source
Startup-folder file and "Chrome Updater" run key FBI investigations AA25-203A
Scheduled tasks named ScheduledDefrags, TempDefrag, TimeSync, TimeSyncro, TimeSyncDrive, TimeSyncroDriver; ScheduledDefrags on a print server executing a .log payload via node.exe FortiGuard case, 2025; Sophos case, March 2026 FortiGuard IR, Sophos incident report
Slopoly PowerShell C2 client under C:\ProgramData\Microsoft\Windows\Runtime\ with a "Runtime Broker" scheduled task, holding a server for more than a week X-Force engagement, early 2026 IBM Slopoly
ScreenConnect as a service, cracked in at least one CISA case; AnyDesk CISA; FortiGuard; Amazon AA25-203A, FortiGuard IR, Amazon
Memory-resident Java webshell; redundant JavaScript and Java RATs; systemd-persisted HAProxy relays FMC campaign, 2026 Amazon
Added domain-administrator accounts; about 5,000 bulk-created domain accounts Sophos case; FortiGuard case Sophos incident report, FortiGuard IR
Certify, able to request authentication-capable certificates Recovered tool; no certificate issuance is reported Amazon

The reviewed evidence does not support a representative Interlock dwell time. One case ran from a 31 March 2025 infection to encryption on 10 to 12 October 2025 with months of inactivity in between; another reached the domain controller in about 26 hours and was contained after several further days; a third held one server for more than a week with a backdoor deployed late in the intrusion; the exploitation clocks above are campaign windows, not residence times. TIR assessment: record four clocks separately in any Interlock investigation: earliest evidenced access, first malicious execution on a domain-joined system, first confirmed data access or transfer, and encryption. The FortiGuard case shows why the first clock matters: the foothold predated the visible intrusion by five months.

Detection opportunities

Every row below is illustrative: derived from the cited behaviour and untested by TIR. Cisco's own detection content for CVE-2026-20131 is Snort rules 66082 and 66083, linked from its advisory.

Behaviour Telemetry and location Assumptions and false positives
FMC exploitation and follow-on Snort 66082 and 66083 on traffic to the management interface; proxy and firewall logs for outbound HTTP PUT from an FMC, then an executable fetch; the hunts and query in our March article Assumes the FMC's own egress is logged off-box; the webshell leaves no file, so disk forensics alone cannot clear it
ClickFix execution Process-creation telemetry for explorer.exe or the Run dialog spawning PowerShell with curl or a download cradle; the RunMRU registry key, which IBM recommends monitoring; outbound PowerShell network connections, which FortiGuard recommends blocking outright Administrators and developers trigger similar events; scope by user population
Node.js or Java runtime executing a payload with a non-script extension Process telemetry for node.exe or javaw.exe with a .log or .txt argument from a user profile, system profile or temporary path (j1wp4vw8.log, debug.log, node.log, zoom.txt in the cases) Developer workstations run node.exe legitimately; the argument extension is the discriminator
Scheduled-task persistence Task creation events (4698) and Task Scheduler operational log for the names above, for "Runtime Broker" and for a "TaskSystem" task created, run and deleted within minutes, or any task executing node.exe; ScheduledDefrags recurred across two vendors' cases Task names are case-specific and will change; alert on the executable, not the name
Slopoly PowerShell scripts or a persistence.log under C:\ProgramData\Microsoft\Windows\Runtime\; proxy logs for HTTP POST to a "/api/commands" path at 30-second and 50-second cadences from a server; the C2 in the indicators table Cadence-based hunts need a baseline of the host's normal traffic
Memory credential theft Process telemetry for winpmem or volatility executables and for python invoking hashdump or cachedump; Sophos notes the same traces arise from legitimate DFIR use Confirm with the IR team before escalating
Hotta Killer Service-creation events (7045 or 4697) for a kernel-driver service with a name beginning UpdateCheckerX64_, a driver file written to a working directory, rundll32 with a "start" argument and a wildcard, and PowerShell loops that re-spawn rundll32 The driver is validly signed; detection rests on the service and file location, not the signature
WDAC policy tampering New policy files under System32\CodeIntegrity or CiPolicies, RefreshPolicy.exe execution, Code Integrity operational log events for policy activation; GPO changes that deploy a policy Legitimate policy deployments produce the same events; compare against the change record
EDR uninstall, service kill and self-deletion Uninstaller execution for the endpoint agent, taskkill or PsExec targeting security or integrity-check processes, Defender real-time protection disabled, event-log clearing (1102); rundll32 loading a tmp.wasd file from a temporary folder, the encryptor's and Supper's self-delete DLL Scheduled maintenance can match; sequence and account context separate it
Mass account creation Bursts of 4720 events from one source after a domain-admin logon A provisioning job can look similar; the FortiGuard case created about 5,000 in one run
AzCopy and Storage Explorer Execution on file servers; sustained outbound transfer to Azure blob endpoints from a server that does not normally use them Legitimate migrations; check who launched it and where the destination account lives
Hypervisor access SSH logins to Nutanix or ESXi hosts and Prism Central logins from workstations or unusual accounts; disk-level encryption commands in shell history Administrators do this; the source host and timing are the signal

Mitigation and recovery beyond the encryptor

These are TIR recommendations drawn from the case evidence, except where a source is named.

  1. Close the appliance, preserve its memory, then distrust it. Upgrade FMC to the fixed release the Cisco Software Checker returns; Cisco offers no workaround, and SCC Firewall Management customers need no patching action because Cisco has deployed the fix, though they should still review exposure and logs. If an FMC management interface was reachable from the internet at any time since 26 January 2026, treat the device as possibly compromised: because Amazon's webshell is memory-resident, capture volatile memory and the running JVM state before any reboot or upgrade, and preserve the FMC's logs and the surrounding proxy and firewall logs. Then rebuild rather than patch in place: the flaw gives unauthenticated code execution as root, and Amazon's toolkit includes self-deleting RATs and relay infrastructure, so patching alone does not establish that a device is clean. A clean endpoint estate does not answer the appliance question. Cisco PSIRT, Amazon
  2. Recover identity as a compromised trust boundary. The cases show memory credential dumping, Kerberoasting, added domain-administrator accounts, thousands of bulk-created accounts and dumped AWS keys. Reset domain-administrator and service-account credentials from a trusted system, enumerate accounts created since the earliest evidenced access, investigate them, and remove confirmed unauthorised accounts, rotate cloud keys found on compromised hosts and review their use, and audit AD CS for certificates issued to unexpected requesters because Certify was in the toolkit. Sophos incident report, FortiGuard IR, Amazon
  3. Verify backups and inventory before you need them. Sophos's customer believed it had backups and did not, and without up-to-date network documentation and a complete inventory could not establish what should exist in the virtual environment it was locked out of; the rebuild was unavoidable. Test restoration of the critical service, not the existence of a backup file, and keep the inventory and hypervisor credentials outside the domain the attacker owns. Sophos incident report
  4. Treat hypervisor and management-plane access as in scope. The FortiGuard operators reached Nutanix with an existing administrator account over SSH. Rotate hypervisor credentials, review SSH and Prism or vCenter logins, and separate hypervisor administration from domain credentials. FortiGuard IR
  5. Remove the retained execution, not just the encryptor. Scheduled tasks, run keys, ScreenConnect or AnyDesk services, host-firewall RDP allow rules added with netsh, rogue WDAC policies and the GPOs that deliver ransom notes or policies all outlive file restoration. FortiGuard's three low-cost controls apply directly: block remote-access software not in use and alert on attempts, block workstation-to-workstation SMB and RDP, and block outbound PowerShell network connections; IBM adds disabling Win+R or monitoring RunMRU against ClickFix. FortiGuard IR, IBM X-Force, IBM Slopoly
  6. Close the coverage gaps the cases exploited. FortiGuard's first infected laptop had no EDR, and Sophos found endpoints in its customer's estate with no protection at all. Audit endpoint-agent coverage against the inventory, and keep security tooling able to detect its own uninstallation and service termination, which Talos observed Interlock attempting. FortiGuard IR, Sophos incident report, Talos Q3 2026
  7. Plan for the data, not only the systems. Interlock exfiltrates before encrypting and its ransom note cites data protection regulations as leverage. Scope the transfer from AzCopy and Storage Explorer execution, volumes and destinations; a successful restore does not answer what was taken. AA25-203A, Amazon

The joint advisory's baseline recommendations on DNS filtering, patching known exploited vulnerabilities, segmentation, EDR on virtual machines, phishing-resistant MFA and offline, immutable, tested backups remain the foundation.

Indicators: scope and validity

Amazon warns that Interlock varies scripts and binaries per target, so most file hashes are unreliable; the joint advisory warns that several hashes it lists belong to legitimate tools such as AnyDesk, PuTTY, WinSCP, PsExec and ScreenConnect. The indicators below are selected for cross-source corroboration or durability and carry their observation windows; they support retrospective scoping, and absence of a match clears nothing.

Indicator Context Window Source
37.27.244[.]222 Staging host reported by Amazon and analysed by IBM March 2026 Amazon, IBM X-Force
browser-updater[.]com C2 domain in Amazon's list and in the Sophos case March 2026 Amazon, Sophos incident report
JA3 b885946e72ad51dca6c70abc2f773506; JA4 t13i1811h1_85036bcba153_b26ce05bbdd6 Exploit TLS fingerprints seen in January and March Jan to Mar 2026 Amazon
TCP 45588 Connectivity beacon port March 2026 Amazon
plurfestivalgalaxy[.]com; 94[.]156[.]181[.]89; script SHA-256 0884e5590bdf3763f8529453fbd24ee46a3a460bba4c2da5b0141f5ec6a35675 Slopoly C2 domain and IP, and the redacted script IBM uploaded Early 2026; domain no longer active IBM Slopoly
Cloudflare tunnel hostnames under trycloudflare[.]com Hardcoded C2 in NodeSnake and InterlockRAT samples; IBM lists the specific names Early 2026 IBM Slopoly
user[.]kangaroosim[.]com ScreenConnect relay used in the FortiGuard case Sep to Oct 2025 FortiGuard IR
polers.dll SHA-1 3B9B2D5934F9ED1E3A000A760A6FA90422E8A555; UpdateCheckerX64.sys SHA-1 7556AE58C215B8245A43F764F0676C7A8F0FDD1A Hotta Killer loader and the renamed vulnerable driver October 2025 FortiGuard IR
.interlock, .1nt3rlock, .!nt3rlock, .gif, .!NT3RLOCK, .int3R1Ock; notes !README!.txt and FIRST_READ_ME.txt Encrypted-file extensions and note names across variants 2024 to early 2026 AA25-203A, FortiGuard IR, IBM Slopoly

The full lists are in the sources; validate time bounds before any blocking use.

Open questions

  • What Sophos's "two weeks" measures. Sophos neither gives its evidence nor says which Cisco statement it counts from. Until it does, the pre-disclosure window rests on Amazon's honeypot account, which Cisco's advisory does not confirm.
  • Whether every CVE-2026-20131 exploitation is Interlock. Amazon's attribution covers its observed campaign. No retained source reports a second actor, and none excludes one.
  • How many hands. IBM's vendor IDs, the wider Supper user base and its "subclusters" description leave open whether Interlock is one team or several sharing a framework; no source has resolved it.
  • The WDAC policy in live intrusions. Talos reports a deployed policy in earlier activity and IBM found one on a staging server; no retained source describes a victim-side deployment in detail.
  • The purpose of the 5,000 accounts. FortiGuard could not establish it; the obvious hypotheses, persistence, noise or extortion leverage, are untested.
  • Naming. Neither a Microsoft Storm or Tempest name nor a CrowdStrike designation for Interlock appears in the retained sources. GOLD EMBRACE and Hive0163 are vendor cluster names for the operators, not ransomware-family names.
  • Current victims. Leak-site claims from September and October 2026 circulate in secondary reporting; this profile does not treat them as verified incidents or name the organisations.

Related TIR coverage

Sources

Version history

Version 1 — 31 October 2026: Initial living profile. Verifies CVE-2026-20131 against the Cisco advisory and the European registry; separates Amazon's, Sophos's and Cisco's exploitation clocks, and the pre-disclosure use of CVE-2025-61155, from victim dwell time; adds the FortiGuard, Sophos and X-Force cases, the Hotta Killer, WDAC and Slopoly evidence, and the Talos Q3 observations; sets out the shared-code relationship with Rhysida and the evidence that limits "closed group" without merging the operators; and extends recovery to identity, hypervisor, backup and coverage findings.

Research refreshed on 9 November 2026. Source publication dates and the dates of the underlying activity remain distinct; this is a researched assessment, not a claim of newly observed activity on the publication day.