Case study
Interlock encrypts a county hospital's systems after a domain takeover
Staff were lured by a ClickFix-style fake verification page into running a command; after taking domain admin the operators pushed the Interlock encryptor estate-wide via GPO, hitting HIS, LIS, EMR and the file servers at once. A clean domain was built in an isolated segment before clinical systems were restored in batches.
- Industry
- Healthcare Ransomware Response and Recovery
- Family
- Interlock
- Scenario
- Domain-Wide Encryption
- Handled
- 2026-05
This case study is composed from typical scenarios to illustrate our approach and the recovery paths involved. It does not describe a specific customer incident; real cases involving customer data are published only with authorization.
约 93%
Core clinical data recovered
约 36 小时
Outpatient core chain restored
9 个工作日
Full estate recovery completed
0
Ransom paid
Incident background
The client is a county-level general hospital whose HIS, LIS, electronic medical records and file servers all sit in one Windows domain, with core systems on a small virtualization platform. Outpatient, inpatient, diagnostic and administrative areas share a flat network, and domain administrator accounts were shared among a few IT staff who also used them on ordinary office endpoints.
It began when an administrative employee browsing a routine website was redirected to a page demanding human verification and instructing the user to press Win+R and paste a command. That endpoint then received a 64-bit executable masquerading as conhost.exe. From this foothold the operators harvested credentials with infostealer tooling, moved laterally over RDP and remote control utilities, and obtained domain administrator rights within roughly ten days.
In the early hours of one morning they added software distribution and startup script entries to Group Policy, pushing the encryptor to every domain-joined host. Before clinics opened, HIS would not log in, files carried an appended .interlock extension, and !README!.txt notes appeared in every directory, offering only a victim-specific code and an onion address, no mailbox and no figure. The domain controllers were encrypted and domain logons failed broadly. Shadow copies had been deleted, and the backup server, inside the domain and running under a domain administrator account, was encrypted too. Only an offline tape set held a full copy from about five days earlier - a point already inside the attackers' dwell window.
What we did
Containment went out on the first call: cut SMB, RDP and WinRM lateral paths by segment, drop external connectivity, keep hosts powered on without reboot or reinstall, and activate the clinical downtime procedure.
- Forensic imaging. Read-only images of the domain controllers, backup server and core application servers, with AD and GPO change records, DNS and cloud storage access logs exported. Because the encryptor self-deletes, deleted-file recovery retrieved the sample and the original !README!.txt.
- Family confirmation and recoverability. The .interlock extension, !README!.txt note and file structure confirmed Interlock - AES content encryption with RSA-wrapped keys, no public decryptor, so decryption was ruled out. Encrypted-proportion measurement mapped the intact regions, and tapes were verified by mount.
- Recovery execution. Domain admin had been held, an NTDS.dit export could not be excluded and the tape sat inside the dwell window, so the domain was rebuilt clean in an isolated segment, with old credentials and cloud storage keys invalidated. Business data returned in clinical-priority batches, gaps filled by page-level extraction and log roll-forward.
- Hardening. Servers were cleared of Interlock RAT, Cobalt Strike and unauthorised remote control tools before rejoining; endpoints were reimaged. Pasted PowerShell and self-service installs were blocked, clinical and office zones segmented, vendor access funnelled through a jump host, backups moved out of the domain with immutable offline copies, GPO changes under audit alerting.
- Deliverables. An incident timeline and kill-chain report, a scoped exfiltration assessment, recovery and validation records, a hardening checklist, and staff material on ClickFix-style lures.
Recovery result
The core outpatient chain - registration, consultation, order entry, billing and dispensing - was running again after about 36 hours, with paper prescriptions and manual registration carrying the clinics throughout. Batched recovery of the remaining systems took nine business days. Core clinical data was recovered to roughly 93 percent: current inpatient information, orders and medication, and billing and settlement records were continuous and queryable, with counts and settlement totals reconciled against the departments.
What could not be recovered sat in the five-day window between the tape copy and the encryption: some raw laboratory data, a few imaging series, and a set of administrative and research documents. Laboratory results were reissued from paper reports and instrument-side retention, and imaging gaps re-acquired where clinically needed. Paper records from the outage were entered department by department against a hospital-set deadline, with item-level checking.
Forensics confirmed that the operators had used cloud storage tooling to exfiltrate parts of several directories. We delivered a scoped exfiltration conclusion, supported the hospital's report to its competent authority under its own classification, and advised on notification and monitoring for the patient information involved. No ransom was paid and no contact was made with the operators. Recommendations: separate domain administrator accounts from office accounts with MFA, run a downtime and recovery drill each year, and re-verify backup restorability quarterly.
This is an illustrative case compiled from typical scenarios and anonymized; it does not refer to any specific client.
Emergency response
Data already encrypted? Stop and let an engineer look first
We do not pay ransoms and we do not negotiate with attackers. Engineers run a free assessment first, then propose a recovery plan and a firm quote.
Related content
Domain Controller Compromise and Estate-Wide Encryption
A compromised domain controller hands the attacker a legitimate administrator identity, allowing an encryptor to be pushed to every host at once through Group Policy or remote execution. This page covers how such incidents present, the correct order for Active Directory recovery, and how to decide between cleanup and full rebuild.
Healthcare Ransomware Response and Recovery
When a hospital is hit, registration, consultation, orders, billing, laboratory and imaging fail at the same moment and care falls back to paper. This page covers the healthcare threat picture, a recovery priority built around clinical continuity, and the handling of patient data and compliance obligations.
- No public decryptor
Interlock
Interlock emerged in September 2024 as a double-extortion crew marked by .interlock / .1nt3rlock extensions and the !__README__!.txt note. It relies on drive-by downloads, ClickFix fake-CAPTCHA social engineering and edge-device zero-days, and was covered by a CISA #StopRansomware advisory in 2025. No public decryptor exists.