Anatomy of an Attack

Introduction

Many ransomware groups operate using the Ransomware-as-a-Service (RaaS) model, selling pre-packaged ransomware tools to independent affiliates. The Interlock ransomware group, however, employs a different model keeping their operations completely in-house. This enables maximization of profit margins and strict control over their campaigns.

Interlock's strategy mirrors a shift across the broader threat landscape. According to Verizon’s 2026 Data Breach Investigations Report (DBIR), vulnerability exploitation has surpassed stolen credentials to become the number one initial access vector for cyber breaches, driving 31% of all network intrusions. The DBIR also highlights a dangerous trend of ransomware showing up in 48% of all breaches, yet organizations take a median of 43 days to patch a known flaw. Additionally, generative AI actively accelerates this macro shift, which has made scanning for and chaining edge vulnerabilities faster and more accessible for groups like Interlock.

Interlock capitalization on these trends became clear in January 2026, when they bypassed user interaction entirely to exploit a critical zero-day vulnerability (CVE-2026-20131) in Cisco Secure Firewall Management Center (FMC) software, allowing them to gain root-level privileges. Concurrently, the group began deploying a novel command-and-control (C2) framework called Slopoly, a functional backdoor that threat intelligence teams assess was built using generative AI. The group’s actions went unnoticed until Amazon threat intelligence teams retroactively discovered the exploitation within their honeypot platform, disclosing the findings on March 18, 2026. Because it took 36 days for a patch to be released, Interlock achieved significant lead time to compromise vulnerable enterprise devices.

Automation and AI simply expand an attacker's reach, rather than replacing traditional tactics. Once inside a compromised system, Interlock excels at blending into the network environment. Alongside custom scripts, the group heavily relies on a tactic known as “living off the land binaries and scripts” (LOLBINS). By abusing legitimate, built-in administrative utilities, the actors move laterally, stage data, and execute their payloads. Because these utilities are trusted by the operating system, Interlock’s actions in the network can easily evade traditional defenses.

Analysis of Interlock’s Attack Chain

Phase 1: Initial Access

Historically, Interlock’s initial access techniques have relied heavily on user execution [T1204] by leveraging a variety of user-browsing methods including:

• compromising legitimate website to execute drive-by downloads [T1189],
• deliver malicious payloads disguised as fake browser updates, and
• using ClickFix social engineering to disguise malicious payloads as CAPTCHAs [T1204.004].

In the January 2026 campaign, Interlock advanced its capabilities by targeting a zero-day vulnerability in network edge infrastructure directly. By sending specifically crafted HTTP requests containing serialized Java code to vulnerable Cisco Secure FMC devices (CVE-2026-20131), the actors bypassed authentication entirely to achieve remote code execution (RCE) as root. This shift allowed them to compromise networks silently without requiring user interaction.

Phase 2: Initial Foothold, Staging, and Malware Delivery

No matter the initial access method, Interlock prepares the environment for broader exploitation. They used actor-controlled infrastructure to retrieve staging tools [T1105] like BITSAdmin, PowerShell scripts [T1059.001], or ELF binaries [T1059.004]. These tools allow them to conduct network reconnaissance and deliver their final payloads.

While Interlock favors LOLBINS to blend into normal network traffic, they also deploy a custom toolkit including:

• Malicious PowerShell scripts to enumerate system environments or download second-stage backdoors such as NetSupport RAT or Slopoly backdoor.
• Memory-Resident Webshells: In the Cisco FMC campaigns, Interlock dropped a Java class file directly into memory instead of writing an ELF binary to disk. Once the Java Virtual Machine (JVM) loads the file, it registers as a listener to intercept HTTP requests, specifically filtering on encrypted actor commands and decrypting them. The commands are executed entirely in memory, effectively evading traditional antivirus (AV) file scans.
• Proprietary and Commodity Malware: The group leverages proprietary tools like Interlock Locker, Interlock RAT and NodeSnake RAT.

Phase 3: Persistence and C2

To ensure long-term access, Interlock sets up redundant persistence through system configurations and remote access tools. They camouflage their persistence by creating scheduled tasks [T1053.005] that mimic native system processes. In addition, to run at startup,they configure registry startup keys [T1547.001] and shortcut files in the startup folder.

For a secondary access method, Interlock installs legitimate remote administrative tools [T1219.002] like NetSupport Manager (weaponized name is NetSupportRAT) or remote desktop tools such as ConnectWise ScreenConnect. This allows their administrative traffic to blend in with authorized IT operations and HTTP traffic, making detection difficult. Concurrently, their proprietary Interlock RAT establishes a real-time, bidirectional WebSocket connection to attacker infrastructure, allowing them to bypass firewalls using SOCKS5 tunnels and set up reverse shells.

Slopoly’s novelty is how it reshapes the economics of cybercrime by serving as a speed and efficiency multiplier for threat actors. AI-generated malware doesn't bring new or complex exploitation techniques to the table. Instead, it disproportionately empowers attackers by drastically shrinking development cycles from months down to days. By dropping the cost of building functional backdoors to practically zero, this framework allows operators to easily churn out unique, disposable iterations on demand.

Phase 4: Lateral Movement and Privilege Escalation

Once their foothold is secured, Interlock begins enumerating the internal network [T1135] to harvest credentials [T1003] and escalate privileges [T1068]. During the January 2026 Cisco FMC intrusion, researchers found the group pre-staging specific offensive utilities:

• Volatility: An open-source memory forensics tool repurposed to extract cleartext credentials from temporary computer memory.
• Certipy: Used to identify misconfigurations within Active Directory Certificate Services (AD CS), allowing the attackers to elevate their privileges [T1649].

In other campaigns, Interlock utilized Advanced Port Scanner to map internal subnets, locate domain controllers (DCs), and identify virtual machine hypervisors. While performing reconnaissance, they attempted to gain administrative access by brute forcing password resets, harvested an administrator's credentials in LastPass and subsequently used them [T1078] to log into core corporate services. By enabling Restricted Admin mode to bypass multi-factor authentication (MFA) and dump LSASS credentials from active Microsoft 365 sessions, the actors successfully pivoted via Remote Desktop Protocol (RDP) directly into DCs, Exchange servers, and Hyper-V environments.

Phase 5: Obfuscation and Data Exfiltration

Interlock ensures they possess maximum leverage by stealing sensitive data before deploying any disruptive encryptors. To mask their origin, they establish proxy-based relay infrastructure [T1090] and routinely wipe event logs [T1070] to erase forensic evidence.

Their exfiltration techniques evolved between 2025 and 2026:

• Standard Cloud Abuse (2025): Interlock routinely abused legitimate cloud storage tools like AZCopy or Azure Storage Explorer to exfiltrate stolen data over secure TLS/HTTPS tunnels directly to actor-controlled Azure Storage blobs [T1567.002]. They also deployed native file transfer [T1048] utilities like WinSCP to move data outward quietly.
• Advanced Proxying (2026): In their latest operations, Interlock used Bash scripts to configure compromised Linux servers as HTTP reverse proxies using HAProxy and fail2ban. These nodes forwarded all inbound traffic to a hardcoded attacker IP, obscuring the true destination of the stolen data. To finalize their cover, the actors set up a routine cron job [T1053.003] to wipe all system logs in the /var/log path every five minutes.

Phase 6: Anti-Analysis and Ransom Deployment

To ensure the attack succeeds without interference, Interlock has deployed a custom defense-evasion utility known as Hotta Killer. This malware exploits a zero-day vulnerability (CVE-2025-61155) in a legitimate third-party anti-cheat driver (GameDriverX64.sys) to gain kernel-level access. Operating at the kernel level allows Hotta Killer to bypass operating system permissions, map out active Endpoint Detection and Response (EDR) or antivirus controls, and disable them [T1685].

With the host left entirely undefended, the attackers use AnyDesk [T1219.002] on a DC, alongside PsExec [T1021.002], to simultaneously push and execute the Interlock ransomware binary across every host in the domain. Within minutes, Windows and FreeBSD operating system files are encrypted [T1486], appended with the .interlock extension, and network-wide ransom notes titled !__README__!.txt are delivered.

The Adversary’s Toolkit: MITRE ATT&CK TTPs

ExtraHop NDR Detection & Capabilities

The activities of the Interlock ransomware group highlights why enterprise resilience cannot depend on a single telemetry source. Endpoint telemetry provides internal visibility, capturing host-level behaviors such as user execution, registry changes, and file modifications. Network telemetry adds the ability to observe the interactions between systems, including remote access, lateral movement, and data exfiltration across hybrid and cloud environments.

When attackers weaponize zero-day vulnerabilities or deploy AI-assisted malware, defenders are racing against the clock. Securing an enterprise against evolving threats requires looking beyond basic logs and adopting a defense-in-depth framework. ExtraHop RevealX delivers the network detection and response (NDR) capabilities required to close this visibility gap. By analyzing raw data directly from the wire with zero-lag decryption, RevealX exposes advanced adversary tradecraft in real time, delivering alerts, so defenders can isolate and stop an intrusion mid-attack.

ExtraHop RevealX is well positioned to complement endpoint and identity controls by analyzing network behavior at scale. In the Interlock toolkit, the most relevant network-observable behaviors include C2 beaconing, new remote access software activity, and Azure account exfiltration. These are the kinds of behaviors defenders should validate against their environment before an incident, not after encryption begins.

Interlock’s attack methodology demonstrates the ongoing challenge of identifying legitimate administrative workflows from malicious, adversary-operated access. The group regularly exploits dual-use and remote access tooling such as NetSupportRAT, AnyDesk, and PsExec. Because these tools are common in enterprise management, they rarely trigger automated endpoint blocks. However, their network behavior becomes suspicious when they authenticate from unexpected hosts, connect to uncommon peers, or initiate unusual remote services. ExtraHop can help connect protocol behavior, data volume, and lateral movement into a contextual attack narrative that distinguishes normal administration from adversary tradecraft.

For an Interlock intrusion, high-value threat-hunting investigations should focus on behaviors that connect the phases above:

• New or rare remote access tools communicating from servers or domain controllers, especially AnyDesk or NetSupportRAT activity that appears outside normal administrative patterns.
• Endpoints transferring executables over SMB to multiple peers, followed by remote service creation, PsExec-style activity, or other lateral movement indicators.
• Internal hosts initiating unusual outbound traffic to Azure Blob Storage, especially with AZCopy user agents, renamed AZCopy binaries, or storage account names not previously seen.
• Recurring HTTP beaconing to suspicious or newly observed domains, including periodic /api/commands-style polling associated with C2 behavior.
• Suspicious HTTP requests or archive downloads that precede RAT deployment, PowerShell execution, or follow-on operator access.
• Network share discovery or unusual SMB enumeration activity from accounts or hosts that do not normally perform administrative reconnaissance.
• File access, service creation, and lateral movement behaviors converging on the same hosts before encryption or ransom-note activity.

Conclusions and Recommendations

Technical takeaways

• What makes the Interlock Ransomware Group stand out is not one exotic technique. The Interlock ransomware group stands out in the way they combine several high-risk behaviors into a flexible and adaptive ransomware playbook, requiring defenders to have defense in depth.
• The playbook abuses legitimate administrative and cloud tools, including PowerShell, PsExec, and AZCopy. Legitimate-tool abuse should be modeled as behavior, not simply as file reputation.
• Cloud storage exfiltration is a critical pre-encryption detection opportunity. AZCopy activity to unfamiliar Azure Blob destinations should be investigated when it appears on systems that do not normally perform these types of transfers.
• The ransomware phase is late in the intrusion. The most actionable detection opportunities occur earlier in the kill chain.
• Public reporting shows Interlock continuing to evolve. Defensive control validation should be repeated as new reporting emerges.

Recommended response

• Patch and reduce exposure for internet-facing management interfaces. Where Cisco Secure FMC or similar management interfaces are present, validate patch status, exposure, and access controls immediately.
• Restrict and monitor remote management tooling. Inventory RMM software; alert on first-seen use from sensitive servers and domain controllers.
• Constrain PowerShell and LOLBin abuse. Enforce script logging, PowerShell Constrained Language Mode where appropriate, and controls around BITSAdmin and other living-off-the-land transfer utilities.
• Harden identity and credential stores. Enforce MFA, remove dormant accounts, rotate credentials, and monitor for unusual administrative logins and session hijacking patterns.
• Monitor cloud data movement for anomalous or unusual behavior. Baseline approved Azure Storage, S3, and other cloud storage destinations behaviors; investigate high-volume uploads from unusual hosts or accounts, especially before business-hours anomalies or account lockouts. NDR detections should be able to identify much of this for you.
• Segment critical systems and limit SMB lateral movement. Restrict administrative shares, monitor PsExec-style remote service creation, and enforce least privilege for administrator accounts.
• Validate recovery. Maintain offline, immutable backups and routinely test restoration procedures for systems and data stores that are likely to be targeted before encryption.

Additional Resources

• https://aws.amazon.com/blogs/security/amazon-threat-intelligence-teams-identify-interlock-ransomware-campaign-targeting-enterprise-firewalls/
• https://cyble.com/threat-actor-profiles/interlock-ransomware-group/
• https://learn.microsoft.com/en-us/azure/storage/common/storage-use-azcopy-v10
• https://thehackernews.com/2026/03/interlock-ransomware-exploits-cisco-fmc.html
• https://www.bleepingcomputer.com/news/security/ai-generated-slopoly-malware-used-in-interlock-ransomware-attack/
• https://www.broadcom.com/support/security-center/protection-bulletin/interlock-ransomware-activity-continues-into-2026
• https://www.cisa.gov/sites/default/files/2025-07/aa25-203a-stopransomware-interlock-072225.pdf
• https://www.darkreading.com/threat-intelligence/interlock-ransomware-targets-cisco-enterprise-firewalls
• https://www.darktrace.com/blog/netsupport-rat-how-legitimate-tools-can-be-as-damaging-as-malware
• https://www.fortinet.com/blog/threat-research/interlock-ransomware-new-techniques-same-old-tricks
• https://www.fortinet.com/blog/threat-research/ransomware-roundup-interlock
• https://www.guidepointsecurity.com/blog/interesting-interlock-intrusion-how-interlock-achieves-encryption/
• https://www.haproxy.com/glossary/what-is-haproxy
• https://www.paloaltonetworks.com/cyberpedia/what-is-ransomware-as-a-service
• https://www.verizon.com/business/resources/reports/2026-dbir-data-breach-investigations-report.pdf

Learn More About ExtraHop

The network usually tells the story that logs and endpoints often miss. If you want to see how this actually works in practice, or if you're just curious about how your own environment holds up, there are a few ways we can help:

• See it in action: We can jump on a quick call to show you how RevealX NDR picks up on the TTPs used in the Interlock ransomware campaign.
• Check your blind spots: We offer a simple network security assessment to help you find out if there’s activity moving sideways through your environment that your current tools aren't catching.
• Your experts speak with our experts: If you have specific questions your team can spend time with ours.

Click HERE to schedule your time with us and learn more about ExtraHop RevealX NDR.