Interlock ransomware gang deploys new NodeSnake RAT on universities

Interlock ransomware operators are using a newly observed NodeSnake RAT (NodeJS-based) against UK universities via phishing, establishing stealthy persistence (fake 'ChromeUpdater' registry key), evading detection with heavy obfuscation and Cloudflare-proxied C2, and enabling reconnaissance, command execution, payload loading, and data exfiltration; multiple divergent samples indicate active development and QuorumCyber provides full IoCs for detection and blocking.