Interlock ransomware: Evolving under the radar with ClickFix

This report details the Interlock ransomware intrusion set (active since Sept 2024), describing its multi-stage attacks that use fake browser/security updaters and ClickFix social-engineering to deliver a PowerShell backdoor, credential stealers (Lumma/Berserk), a custom-packed RAT, and a C/C++ ransomware for Windows and Linux; it includes TTPs for persistence, lateral movement, exfiltration, ransom notes, IoCs (hashes, domains, IPs, URLs), and YARA rules to aid detection and response.