Game Over: Interlock Ransomware Weaponizes Anti-Cheat Zero-Day to Kill EDR

Interlock, a small but sophisticated ransomware group, ran a months-long campaign against the education sector that abused a zero-day in a signed gaming anti-cheat driver (CVE-2025-61155) to bypass defenses and kill EDR, established persistence with MintLoader and the NodeSnake RAT, exfiltrated ~250GB of data with AzCopy, and culminated in destructive encryption of Nutanix servers and Windows endpoints while creating ~5,000 rogue domain accounts.