Interlock is a financially motivated ransomware group that emerged in September 2024, operating as a closed organization with a focus on big game hunting of larger targets. The group employs double extortion tactics, encrypting data while threatening to expose sensitive information, and has developed cross-platform ransomware payloads for Windows and FreeBSD environments, rapidly expanding its operations across North America and Europe.
Key insights
•Utilizes big game hunting tactics, targeting larger organizations.
•Employs double extortion, combining data encryption with threats to publish stolen data.
•Utilizes tactics like fake browser updates, social engineering, and custom toolsets.
•Targets both Windows and FreeBSD operating systems with cross-platform ransomware.
•Gains initial access through compromised websites and deceptive downloads.
•Rapidly adapts its toolset for efficient attacks, maintaining a distinct operational profile.