Interlock and Rhysida Ransomware: IBM X-Force Maps a Shared Ecosystem

IBM X-Force analysis reveals a shared ransomware ecosystem linking Interlock (Hive0163) and Rhysida through common tooling (backdoors like Supper, downloaders, RATs, and private crypters), initial-access brokers, and staging infrastructure; both ran sizeable campaigns with ~80 victims in 2025, leveraged critical vulnerabilities (notably CVE-2026-20131) and bespoke defensive evasion, and exemplify how modern ransomware operations rely on an underground supply chain of brokers, crypters, and loaders.