Interlock
Interlock is a financially motivated ransomware group that emerged in September 2024 and is known for double-extortion attacks combining encryption with data theft. The group has targeted organizations across North America and Europe, including critical infrastructure, with historical victim sectors including education, healthcare, government/public sector, engineering, architecture, construction, manufacturing, and industrial organizations. Education is repeatedly described as its most concentrated sector, including reporting that 27.3% of its victims were education organizations and that its leak site listed multiple K-12 schools. Interlock has been linked to exploitation of the critical Cisco Secure Firewall Management Center vulnerability CVE-2026-20131 as a zero-day beginning on January 26, 2026, 36 days before Cisco publicly disclosed the flaw on March 4, 2026. Amazon attributed this activity to Interlock based on recovered malware, ransom note branding, TOR negotiation infrastructure, and victim tracking patterns. Reported tradecraft from this campaign included crafted HTTP requests to trigger arbitrary Java code execution as root; delivery of a malicious Linux ELF payload; PowerShell reconnaissance scripts; custom JavaScript and Java remote access trojans; a memory-resident Java backdoor/web shell; Linux reverse-proxy and log-wiping scripts using HAProxy; and use of legitimate tools including ConnectWise ScreenConnect, Volatility, and Certify. Amazon assessed with 75-80% confidence that the operators likely work in UTC+3. The group has also been associated in reporting with ClickFix activity, compromise of legitimate websites to infect victims, and NodeSnake remote access trojan deployments against multiple U.K. universities. Federal agencies stated that Interlock emerged in September 2024 and noted potential links to the Rhysida ransomware operation. Victims and claimed victims mentioned in the content include DaVita, Kettering Health, Goodwill Industries International, Lexington-Richland School District Five, West Lothian Council, Peabody, and the city of Saint Paul, Minnesota. The content also states that Interlock claimed responsibility for attacks affecting Texas Tech University System and other schools and healthcare entities.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Government & Administration
- Academia & Research
Where they target
Geographies tied to known operations.
- 🇺🇸 United States
Tradecraft
63 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
5 malware families attributed to this actor across reporting.
Associated vulnerabilities
2 CVEs this actor has used in observed campaigns. 2 of them exploited in the wild.
The Interlock Ransomware Group’s exploitation of CVE-2026-20131 began on January 26, 2026 — weeks before Cisco published its security advisory on March 4... The flaw exists in Cisco’s Secure Firewall Management Center (FMC)... The vulnerability is classified as a critical deserialization of untrusted data issue (CWE-502).
Hotta Killer (Interlock): exploits a gaming anti-cheat driver zero-day (CVE-2025-61155) to attack FortiEDR
Observables
51 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Ransomware group with a notable operational focus on education organizations in Q1 2026.
Named as the threat actor claiming responsibility for the Kettering Health data breach.
Named as the group claiming responsibility for a ransomware attack against a non-profit organization.
Exploiting the Cisco Secure Firewall Management Center zero-day CVE-2026-20131 to gain unauthenticated remote code execution in enterprise networks, establish persistence, conduct reconnaissance and lateral movement, steal credentials, and ultimately deploy ransomware.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.