interlock Ransomware
Tracked since Oct 13, 2024
6
victims recorded
6
in the last 30 days
0
CVEs
3d
Last activity
Interlock is a ransomware group first observed in September 2024 that targets critical infrastructure sectors including healthcare, government, education, and technology across North America and Europe using double-extortion, with 57+ claimed victims including a major US dialysis provider exposing over two million patient records.
Vulnerabilities cited for this group
CVEs associated with the group by ransomware.live. Records not yet published here appear without a link.
No CVE associated with this group in the sources.
Observed tools
Defense Evasion
ProcessHacker · ThreatFire System Monitor driver (BYOVD)
Discovery Enum
Advanced Port Scanner · Azure Storage Explorer
Exfiltration
AZCopy · WinSCP
LOLBAS
PsExec
Networking
PuTTY
Offsec
Cobalt Strike
RMM-Tools
AnyDesk · ScreenConnect
Most affected countries (30 days)
- United States4
- Chile1
Most affected sectors (30 days)
- Manufacturing2
- Retail & E-Commerce1
- Energy & Utilities1
- Healthcare1
- Professional Services1
Victims posted on leak sites, according to ransomware.live. Victim names are not displayed. · View on ransomware.live