Interlock

Interlock is a financially motivated ransomware and data-extortion threat actor active by at least 2024 and still operating in 2026. The group conducts double-extortion operations, combining network intrusion and data theft with threats to publish stolen information on a leak site when victims refuse to pay. Reported victims span healthcare, education, government, manufacturing, logistics, nonprofit, and community-service organizations in multiple countries, including the United States, Canada, the United Kingdom, Ireland, and Australia. Interlock has been linked to opportunistic exploitation of high-severity enterprise vulnerabilities for initial access. In 2026, the group was identified exploiting the Cisco Secure Firewall Management Center zero-day CVE-2026-20131 before public disclosure and patching, demonstrating capability to weaponize perimeter-device flaws against enterprise environments. The group has also been associated with broader exploitation activity tracked in enterprise vulnerability reporting. Interlock is additionally associated with social-engineering-driven intrusion chains, particularly ClickFix-style lures that trick users into executing malicious commands. Reporting ties the operation to repeated use of such techniques over at least a year, often as pre-ransomware access activity. Malware and tooling linked to these campaigns include NodeSnake RAT, HijackLoader, and SnappyClient. NodeSnake in particular has been tied to the Interlock operation and showed signs of ongoing development, including enhanced screenshot collection and possible affiliate-tracking features. Infrastructure used in some of this activity has also been publicly linked to the KongTuke initial access broker, suggesting reliance on external access-enablement or affiliate relationships. Observed victimology indicates broad sector targeting rather than a narrow vertical specialization, though healthcare, public-sector, and education organizations have featured prominently in public reporting. Interlock has claimed attacks affecting municipal government entities, treatment providers, dental and hearing-care organizations, schools, and private companies. Publicly reported incidents indicate the group frequently emphasizes theft of sensitive personal, medical, financial, employee, customer, contractual, and internal business records to increase extortion pressure. Interlock is best characterized as a ransomware gang rather than a nation-state actor. No high-confidence public attribution in this material ties it to a specific government. Known aliases include interlock, interlock_group, interlock_ransomware, and interlock_ransomware_gang.