FBI urges vigilance against Interlock ransomware group behind recent healthcare attacks

The Interlock ransomware group, active since late September 2024, is targeting critical infrastructure and businesses across North America and Europe — notably causing outages at a dialysis provider and a major Ohio healthcare system. Federal agencies (FBI, CISA, HHS) warn Interlock uses drive-by downloads, fake browser updates, and ClickFix social engineering to gain access, employs info stealers (Lumma, Berserk) to harvest credentials, operates Windows and Linux encryptors, and demands Bitcoin with contact-only ransom notes.