Interlock — Ransomware Profile
Interlock is a ransomware group first observed in September 2024 that targets critical infrastructure sectors including healthcare, government, education, and technology across North America and Europe using double-extortion, with 57+ claimed victims including a major US dialysis provider exposing over two million patient records.Also tracked as
Interlock Ransomware
IntelFusions coverage (3)
- Interlock ransomware turns forensics tools against victims 2026-08-05 · Ransomware
- Interlock ransomware claims a DC housing agency and a refugee charity 2026-07-17 · Ransomware
- Newer ransomware crews claim diagnostics maker Hologic and an Australian fire service 2026-06-28 · Ransomware
Tools & malware
- Advanced Port Scanner Network discovery tool
- AnyDesk Remote monitoring and management (abused)
- Azure Storage Explorer / AzCopy Data exfiltration utility
- Berserk Stealer Information stealer
- cht.exe Credential stealer (Golang)
- Cobalt Strike Command and control framework
- Interlock ransomware encryptor Ransomware (Windows/Linux/FreeBSD ELF, AES+RSA)
- Interlock RAT Remote access trojan
- klg.dll Keylogger
- Lumma Stealer Information stealer
- NodeSnake RAT Remote access trojan
- PsExec Remote execution tool
- PuTTY SSH/file-transfer tool (lateral movement)
- ScreenConnect Remote access tool (cracked, abused)
- SystemBC Proxy / C2 malware
- WinSCP File transfer / exfiltration tool
Recent claimed victims
- Gardiner Family Chiropractic 2026-07-31
- Paragon Store Fixtures 2026-07-17
- Centre for Newcomers 2026-07-17
- Converting Equipment International 2026-07-16
- District of Columbia Housing Authority 2026-07-16
- Borger ISD 2026-07-10
- YMCA of Western North Carolina 2026-07-07
- Clearview Eye Centre 2026-06-25
- Reynella East College 2026-06-23
- Cold Front Distribution 2026-06-02
- First United Methodist Church Boerne 2026-05-11
- Kent District Library 2026-05-11
- Park Dental Research 2026-05-11
- Waterford Hotel Group 2026-05-11
- Lonestar Truck Group & Tag Truck Center 2026-05-04
- Winona County 2026-05-01
- Uniwersytet Warszawski 2026-04-15
- Community College of Beaver County 2026-04-03
- The Center for Hearing & Speech 2026-04-02
- Goodwill 2026-03-26
- Delta Manufacturing 2026-03-18
Vendor research
- Their full write-up Sophos
- #StopRansomware: Interlock (AA25-203A) CISA / FBI / HHS / MS-ISAC
- Unwrapping the emerging Interlock ransomware attack Cisco Talos
- Interlock ransomware evolving under the radar Sekoia
- Interlock ransomware group profile ransomware.live