Ransomware Intelligence

Ransomware needs a way in. Stolen credentials are the cheapest one.

Check Your Exposure

interlock Ransomware Group

Ransomware group profile

61Victims
RussiaSource country
94Impact score
Also Known As
ExoLock

Description

Interlock is a financially motivated ransomware group that emerged in September 2024, operating as a closed organization with a focus on big game hunting of larger targets. The group employs double extortion tactics, encrypting data while threatening to expose sensitive information, and has developed cross-platform ransomware payloads for Windows and FreeBSD environments, rapidly expanding its operations across North America and Europe.

Key insights

  • •Utilizes big game hunting tactics, targeting larger organizations.
  • •Employs double extortion, combining data encryption with threats to publish stolen data.
  • •Utilizes tactics like fake browser updates, social engineering, and custom toolsets.
  • •Targets both Windows and FreeBSD operating systems with cross-platform ransomware.
  • •Gains initial access through compromised websites and deceptive downloads.
  • •Rapidly adapts its toolset for efficient attacks, maintaining a distinct operational profile.

Threat Level & Status Breakdown

For interlock · Based on incidents in selected period

4.8threat level
Aggressiveness8/ 10
Lethality0.8/ 10
Criticality5.8/ 10

Status Breakdown

Data Leaked16.4%10
Claimed83.6%51
First seenOct 2025
Last seenOct 2026
Avg ransom—
Payment rate—
Statusactive
Sophistication0
Last updatedOct 8, 2026

Recent activity

Monthly attack count for interlock in the selected period

61Total attacks
8peak in Jul
4.7avg / month
↓ 1 vs first month
OctNovDecJanFebMarAprMayJunJulAugSepOct02468

Intelligence

IOCs, YARA/Sigma rules, and related families for interlock

  1. 7bc15e8ec688c4ae8a4d942a05cd949d
  2. 8bb8f2324aa1aca4da6fbea5cdaad4f66263b545
View full IOC feed500 total

TTPs & Attack Vectors

Tools, initial access, and MITRE ATT&CK techniques for interlock

Other

T1486

T1486

T1490

T1490

T1071

T1071

T1059

T1059

T1562

T1562

T1021

T1021

T1078

T1078

T1547

T1547

T1080

T1080

T1021.001

T1021.001

Victims(61)

United StatesHealthcare
Claimed
1 day ago
United StatesManufacturing
Data Leaked
4 days ago
United StatesHealthcareo2smiles.com
Claimed
4 days ago
United StatesProfessional Servicesbcbenderlaw.com
Claimed
9 days ago
United StatesGovernment & Defense
Data Leaked
10 days ago
United StatesEducation
Claimed
11 days ago
United StatesEducationspringfieldpublicschools.com
Claimed
24 days ago
United StatesGovernment & Defensefortsmithar.gov
Data Leaked
24 days ago
United StatesFinancial Services
Claimed
about 1 month ago
United StatesTechnology
Claimed
about 1 month ago
United StatesOtherconnellenterprisesinc.com
Claimed
about 2 months ago
United StatesGovernment & Defenseangmarcompanies.com
Claimed
about 2 months ago
United StatesHealthcaregardinerfamilychiropractic.com
Claimed
2 months ago
United StatesEducationse.edu
Claimed
about 2 months ago
CanadaGovernment & Defensecentrefornewcomers.ca
Claimed
3 months ago
United StatesManufacturingparagonstorefixtures.com
Claimed
3 months ago
United StatesGovernment & Defensedchousing.org
Claimed
3 months ago
United KingdomManufacturingslitandrewind.com
Data Leaked
3 months ago
United StatesEducationborgerisd.net
Data Leaked
3 months ago
United StatesRetail & E-Commerceymcawnc.org
Claimed
3 months ago

Page 1 of 4