Interlock — Ransomware Profile
Interlock is a ransomware group first observed in September 2024 that targets critical infrastructure sectors including healthcare, government, education, and technology across North America and Europe using double-extortion, with 57+ claimed victims including a major US dialysis provider exposing over two million patient records.Also tracked as
Interlock Ransomware
IntelFusions coverage (5)
- Ransomware victim counts jumped by a third in early 2026 2026-09-16 · Ransomware
- Ransomware crews are going after managers, not just admins 2026-08-06 · Ransomware
- Interlock ransomware turns forensics tools against victims 2026-08-05 · Ransomware
- Interlock ransomware claims a DC housing agency and a refugee charity 2026-07-17 · Ransomware
- Newer ransomware crews claim diagnostics maker Hologic and an Australian fire service 2026-06-28 · Ransomware
Tools & malware
- Advanced Port Scanner Network discovery tool
- AnyDesk Remote monitoring and management (abused)
- Azure Storage Explorer / AzCopy Data exfiltration utility
- Berserk Stealer Information stealer
- cht.exe Credential stealer (Golang)
- Cobalt Strike Command and control framework
- Interlock ransomware encryptor Ransomware (Windows/Linux/FreeBSD ELF, AES+RSA)
- Interlock RAT Remote access trojan
- klg.dll Keylogger
- Lumma Stealer Information stealer
- NodeSnake RAT Remote access trojan
- PsExec Remote execution tool
- PuTTY SSH/file-transfer tool (lateral movement)
- ScreenConnect Remote access tool (cracked, abused)
- SystemBC Proxy / C2 malware
- WinSCP File transfer / exfiltration tool
Recent claimed victims
- Pedigo Products, Inc. 2026-10-12
- Engineers Contractors Fabricators Inc. (ECF) 2026-10-12
- Greentech Environmental 2026-10-12
- Concord Eye Center 2026-10-12
- Valenti Management 2026-10-12
- Nu-Quest Distribution Inc 2026-10-12
- Shalom Christian Academy 2026-10-09
- Riviera Healthcare Center 2026-10-07
- H&L Manufacturing 2026-10-05
- O2 Dental Group 2026-10-05
- Blaise C. Bender, PC 2026-09-30
- Tekko Enterprises, Inc 2026-09-29
- The Center for Kidney Care 2026-09-28
- City of Fort Smith Arkansas 2026-09-15
- Springfield Public Schools 2026-09-15
- NFM Lending 2026-09-07
- Super Systems Inc 2026-08-31
- Southeastern Oklahoma State University 2026-08-19
- Connell Enterprises LLC 2026-08-14
- AngMar Companies 2026-08-11
- Gardiner Family Chiropractic 2026-07-31
- Centre for Newcomers 2026-07-17
- Paragon Store Fixtures 2026-07-17
- Converting Equipment International 2026-07-16
- District of Columbia Housing Authority 2026-07-16
Vendor research
- INTERLOCK Ransomware (Protection Bulletin) Symantec (Broadcom)
- Interlock ransomware gang creates volatile situation Sophos
- #StopRansomware: Interlock (AA25-203A) CISA / FBI / HHS / MS-ISAC
- Unwrapping the emerging Interlock ransomware attack Cisco Talos
- Interlock ransomware evolving under the radar Sekoia