Interlock Ransomware Actors New Tool Exploiting Gaming Anti-Cheat Driver 0-Day to Disable EDR and AV

The report profiles the Interlock ransomware group as a small, sophisticated operator targeting primarily education-sector organizations in the US and UK; they use MintLoader and a JavaScript implant (NodeSnakeRAT) for initial access, exfiltrate data with AZcopy for double-extortion, and deploy a custom EDR/AV bypass named "Hotta Killer" that uses a renamed vulnerable gaming driver (CVE-2025-61155) and a DLL (polers.dll) to terminate security processes before encrypting systems.