The Interlock ransomware crew has started using Volatility3 and WinPmem, two legitimate memory forensics tools that incident responders rely on, to pull Windows password hashes out of a victim's own machines. Sophos found the activity while working a March 2026 incident and published the attack breakdown on August 4.
Sophos tracks Interlock as GOLD EMBRACE. The group emerged in September 2024, currently focuses on North American and European targets in critical infrastructure, healthcare and education, and practises double extortion: it steals data before encrypting systems, then threatens to leak it on a site it calls the Worldwide Secrets Blog. Unusually for the current market it does not appear to run as a ransomware-as-a-service operation. Sophos describes a small, dedicated team that develops its own malware and conducts its own attacks. IntelFusions last covered the group when it listed a Washington DC housing agency and a refugee charity in July, and there is a fuller profile on our Interlock page.
Turning the responder's toolkit around
Volatility3 is the standard open-source tool for taking apart a memory image, and WinPmem, made by Velocidex, captures that image in the first place. Both are what a defender would run. On the first machine the attackers compromised, Sophos saw WinPmem used to capture the system's memory to a file, and then Volatility3 run against it twice: once with the hashdump module, which extracts NTLM hashes, legacy LM hashes and user account information, and once with cachedump, which pulls cached domain credentials, the username and hash pairs left behind by users who logged in previously. The customer knew of no legitimate Volatility3 use on that system.
The appeal for an attacker is that the activity looks like housekeeping. Sophos notes its own application control policy covers Volatility and that customers can choose whether to permit it, but the broader lesson is that a tool with a genuine role in the environment is a poor thing to judge on reputation alone.
How the intrusion ran
The way in was a ClickFix lure, the now familiar trick of showing someone a fake prompt and talking them into pasting a command themselves. The user was searching for Dynamics 365 through ChatGPT and landed on a reputable website that is believed to have been compromised at the time. Five seconds after the device connected to the malicious host, the page read the clipboard. Eight seconds later the user pasted a command into the Run dialogue. It fetched PowerShell code from a staging domain, which used curl to retrieve a remote access trojan and set it to run at startup. The pasted command reached PowerShell through a wildcard path match rather than naming it, to avoid detection.
From there the operators queried Active Directory over LDAP, injected a payload into a trusted Microsoft process to elevate privileges, and ran a Kerberoasting attack, requesting Kerberos service tickets for privileged service accounts so their passwords can be cracked offline. Just over 26 hours after initial access they moved to a domain controller over remote desktop, using an anonymous login to force an NTLM downgrade. On day three, using a stolen domain administrator account, they planted a scheduled task on a print server disguised as the Windows scheduled defrag job, running a Node.js payload named debug.log. Sophos also noted a 24 hour pause in the middle: the attackers established persistence, walked away and came back the next day with a fresh plan.
The end state was the familiar one. Credentials were dumped, including AWS keys, new domain administrator accounts were added, Defender was tampered with, data was exfiltrated and the customer was locked out of its hypervisors. Two things made recovery worse. The backups the IT team believed it had proved not to be available, and the organisation had no current network documentation or asset inventory, so nobody could establish what was supposed to be running inside the affected virtual environments.
A Cisco zero-day, used early
Sophos also reports that Interlock has been actively exploiting CVE-2026-20131, a critical-severity zero-day in Cisco Secure Firewall Management Center, and says evidence shows the group was using it a full two weeks before Cisco acknowledged it. That is a different flaw from the hard-coded password in the same product that CISA added to its exploited catalog in July.
What you should do
Confirm endpoint protection is actually installed and running everywhere, not just where the inventory says it is. In this incident not all endpoints were running protection of any sort, and the machine where the attack started was not covered by the tooling that would have caught the Kerberoasting. Decide deliberately whether memory forensics tools should be allowed to run on production endpoints, and alert when they do. Audit application control policies on a schedule rather than setting them once. Test backup restores instead of assuming them, and keep network documentation and an asset inventory current, because both matter most on the day you have lost access to everything.
The analysis is by Sergio Bestulic, Andrew Bonwell, Karla Soler and Michael Warner of Sophos, with insights contributed by Robert Weiland, AJ Raiola, Nigel Weber, Louai Abboud and Andrew Ludgate. Their full write-up carries the indicator set and detection names.
Indicators
Defanged: the initial malicious host at 64[.]95[.]11[.]22, which resolved to voginc[.]com; the payload server at 104[.]236[.]109[.]139; and the command and control URL hxxp://216[.]203[.]20[.]36/debug[.]log. Sophos also lists browser-updater[.]com as a command and control domain. The PowerShell staging domain afshapiro[.]com has been taken offline since the events described.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.