Interlock Ransomware Decryption & Data Recovery

Interlock was first identified in late September 2024. Its operating model differs from mainstream RaaS - no large-scale affiliate recruitment appears in public reporting, and it reads more like a closed, compact team - yet its tradecraft is distinctive and its reach into critical infrastructure is significant. CISA, the FBI, HHS and MS-ISAC published the joint advisory #StopRansomware: Interlock (AA25-203A) on 22 July 2025, marking its arrival on the regulatory radar.

The initial access methods stand out most. The FBI observed drive-by downloads from compromised legitimate websites, with payloads disguised as browser or security software updates - unusual among ransomware crews. The second main line is ClickFix social engineering: a fake CAPTCHA page persuades the user to copy and run a PowerShell command themselves, later joined by a FileFix variant using the file manager address bar. Both routes bypass traditional email attachment inspection entirely.

In 2026 the group escalated further, exploiting a critical Cisco Secure Firewall Management Center flaw, CVE-2026-20131, as a zero-day more than a month before public disclosure; Amazon's threat intelligence team issued a warning about the campaign. As of September 2026 its leak site listed 124 claimed victims - not the largest volume, but high-value targets concentrated in healthcare, manufacturing, technology, government and critical infrastructure, mainly across North America and Europe.

IBM X-Force reports overlap between Interlock and Rhysida in the Supper backdoor, crypters and the TAG-124/KongTuke traffic distribution system, suggesting a relationship in personnel or resources. For Chinese organisations, ClickFix-style attacks that get the user to paste and execute commands themselves have already appeared in local variants, and combined with fake software-update pages they are a priority concern on the endpoint. No public report confirms a targeted Interlock campaign against mainland China organisations.

Extension. .interlock or .1nt3rlock (leetspeak) is appended, with the original filename preserved.

Ransom note. !README!.txt, whose leading punctuation usually sorts it to the top of directory listings. The CISA advisory notes it is frequently delivered through a group policy object, which itself indicates the domain controller is under attacker control. The note supplies a victim-specific code and an onion address but no email and no figure - the victim must initiate contact through Tor first.

Intrusion-side indicators, often visible earlier than encryption.

• Users reporting that a website prompted a "browser update" and delivered an installer.
• Fake CAPTCHA pages instructing users to press Win+R and paste a command (ClickFix), or to run it via the file manager address bar (FileFix).
• A 64-bit executable on endpoints masquerading as conhost.exe.
• Interlock RAT, NodeSnake RAT, Cobalt Strike or SystemBC command-and-control components.
• Credential stealers including cht.exe, Lumma Stealer and Berserk Stealer.
• Azure Storage Explorer and AzCopy appearing on non-administrative hosts, indicating exfiltration.
• AnyDesk, PuTTY and RDP used for lateral movement.

Self-deletion. After encryption a DLL such as tmp41.wasd invokes a remove routine that deletes the encryptor itself, so forensic work should include recovery of deleted files.

Interlock's chain runs along two main lines - getting the user to act, and hitting edge devices:

• Drive-by downloads. Compromised legitimate websites serve visitors a malicious installer posing as a browser or security software update. Because the source is a site the user visits routinely, success rates are high.
• ClickFix / FileFix social engineering. A fake human-verification page walks the user through running a PowerShell command themselves, or executing it via the file manager address bar, bypassing email and download inspection.
• Edge device zero-days and known flaws. In 2026 CVE-2026-20131 in Cisco Secure FMC was exploited as a zero-day against the enterprise firewall management plane.
• Traffic distribution systems. Payload delivery through TDS infrastructure such as TAG-124/KongTuke.
• Persistence and C2. Interlock RAT, NodeSnake RAT, Cobalt Strike and SystemBC.
• Credential theft and lateral movement. Multiple infostealers harvest credentials, then AnyDesk, PuTTY and RDP carry the operators toward domain controllers and the virtualisation platform.
• Exfiltration. Azure Storage Explorer and AzCopy upload data to cloud storage, so the traffic resembles ordinary cloud sync and is harder to detect.
• Mass deployment. Encryptor and note pushed domain-wide via GPO.

ClickFix-style attacks work by getting the user to execute code manually, past every technical control. Endpoint hardening therefore has to be paired with awareness training and one unambiguous rule: any page that asks you to copy and paste a command is an attack.

Algorithms. The encryptor combines AES and RSA: each file's content is encrypted with its own AES key, which is then wrapped with an RSA public key and written into the file. Without the operators' private key nothing can be reversed, and the CISA advisory discloses no exploitable implementation flaw.

Multi-platform coverage. The Windows encryptor is a 64-bit executable, often masquerading as conhost.exe. A Linux ELF encryptor also exists, and unusually so does a FreeBSD ELF encryptor, analysed as compiled on FreeBSD 10.4. Public analysis holds that these non-Windows builds are aimed primarily at virtual machine image files on virtualisation and storage platforms; before Interlock, only the now-dismantled Hive operation had produced a FreeBSD encryptor.

Execution and clean-up. After encryption a helper DLL deletes the encryptor itself to reduce forensic traces, alongside event log clearing and weakening of endpoint protection.

Recovery inhibition. Volume shadow copies deleted, database and backup services stopped, and network shares and reachable backup locations encrypted where possible.

Double extortion. Data is exfiltrated to cloud storage via Azure Storage Explorer and AzCopy before encryption and published on the Interlock leak site if unpaid. The note deliberately omits any figure and requires the victim to make contact first - a negotiation tactic that allows pricing to be set against the victim's size.