The Interlock ransomware group has escalated its tactics by repurposing legitimate Windows security tools to extract sensitive credentials from compromised systems. This approach underscores the evolving sophistication of cyber threats and the necessity for organizations to reassess their security protocols.
In a recent incident, Interlock utilized Volatility3, a tool typically employed by security professionals for memory analysis, to harvest NTLM and LM password hashes, along with local account information, from an infected Windows 10 workstation. The attackers also targeted cached domain credentials, potentially exposing usernames and password hashes of previous users. To facilitate this, they employed WinPmem, a legitimate memory acquisition tool, to capture the system’s memory image. The presence of these tools in the environment was unauthorized, highlighting the group’s strategy of camouflaging malicious activities within standard forensic processes.
The breach commenced when a user, while searching for Dynamics 365 via ChatGPT, was redirected to a compromised legitimate website. A deceptive ClickFix prompt convinced the user to execute a command in the Windows Run dialog, initiating a PowerShell script that downloaded and executed a remote-access payload. This social engineering tactic granted the attackers initial access, which they rapidly expanded upon.
Within approximately 26 hours, Interlock had progressed from the initial workstation to the domain controller. Their activities included querying directory information, performing Kerberoasting attacks to obtain service account passwords, and executing NTLM downgrade attacks to facilitate lateral movement within the network. By the third day, they had compromised a domain administrator account, created unauthorized scheduled tasks on a print server, and engaged in extensive credential dumping, including cloud credentials. The attackers also tampered with security software, accessed sensitive files, and exfiltrated data before locking the victim out of hypervisors.
Interlock’s operations, active since September 2024, have predominantly targeted organizations in North America and Europe, focusing on critical infrastructure, healthcare, and education sectors. Their modus operandi combines data theft with system encryption, leveraging the threat of public data exposure to pressure victims into compliance.
Notably, Interlock has also exploited a zero-day vulnerability in Cisco Secure Firewall Management Center (FMC) Software (CVE-2026-20131), allowing unauthenticated remote attackers to execute arbitrary Java code with root privileges. This exploitation underscores the group’s adaptability in combining social engineering with the exploitation of newly discovered vulnerabilities.
To mitigate such threats, organizations should ensure comprehensive endpoint protection across all servers and workstations, establish clear policies regarding the use of memory analysis tools, and monitor for unauthorized data collection or credential dumping activities. Regular testing of backup systems, maintaining up-to-date asset inventories, and reviewing application control policies are also crucial. Vigilance in detecting unfamiliar scheduled tasks, suspicious PowerShell executions, and unusual domain queries can help identify and halt intrusions before they escalate to data encryption stages.
Interlock’s innovative use of legitimate security tools for malicious purposes highlights the critical need for organizations to adopt a proactive and layered defense strategy. By understanding and anticipating such tactics, businesses can better protect their systems and data from increasingly sophisticated cyber threats.
