Emerging Threat Actor: Interlock Ransomware

Interlock is a rapidly evolving, highly disruptive ransomware-as-a-service operation descended from Rhysida that conducts destructive double-extortion attacks across Windows and Linux. The group leverages stolen credentials and IABs for initial access, deploys custom loaders and a newly observed PHP-based RAT, uses credential theft tools (e.g., Mimikatz), sabotages recovery (deleting shadow copies, halting backups), and hosts leaked data to pressure victims; it operates via a closed affiliate model, has been linked to 60–80+ intrusions spanning professional services, education, manufacturing, healthcare and retail, and issues tailored ransom demands ranging from hundreds of thousands to several million dollars.