Interlock: An Emerging Ransomware Threat

What’s Notable and Unique

 
• Interlock ransomware attacks observed by Arete involved multiple components in the delivery chain, including the use of a SystemBC RAT, PowerShell scripts, a credential stealer, and a keylogger before the ransomware encryptor binary was deployed and activated.
• Interlock ransomware utilizes Remote Desktop Protocol (RDP) for lateral movement within the victim’s network, along with tools like AnyDesk and PuTTY.
• For data exfiltration, Interlock ransomware leverages Azure Storage Explorer and the AZCopy utility to transfer stolen data to an attacker-controlled Azure storage blob. It has also employed tools like MegaSync and Advanced Port Scanner in attacks.

Analyst Comments

 
The emergence of Interlock ransomware represents a significant shift in the cyber threat landscape, with its focus on big-game hunting and the use of double-extortion tactics. The group’s attacks are characterized by a sophisticated delivery chain, combining various techniques, including the use of remote access tools, PowerShell scripts, and data exfiltration methods. Many of these tactics, techniques, and procedures (TTPs) overlap with tactics displayed by Rhysidia ransomware, indicating a potential rebrand by the threat actor. Notably, a recent attack by Interlock spanned 17 days from initial compromise to the deployment of the ransomware encryptor binary, demonstrating an extended persistence within the victim’s network and highlighting the advanced nature of this threat.