#StopRansomware: Interlock

Date: 07/23/2025

Severity: Critical

Summary

Interlock ransomware, active since late September 2024, targets businesses and infrastructure in North America and Europe with financially driven attacks. The FBI notes its use of encryptors for both Windows and Linux, often impacting virtual machines. Initial access methods include drive-by downloads from compromised sites and the ClickFix social engineering tactic. After gaining access, actors perform discovery and lateral movement, employing double extortion by exfiltrating and encrypting data.

Indicators of Compromise (IOC) List

Hash :

fba4883bf4f73aa48a957d894051d78e0085ecc3170b1ff50e61ccec6aeee2cd

4b036cc9930bb42454172f888b8fde1087797fc0c9d31ab546748bd2496bd3e5

18a507bf1c533aad8e6f2a2b023fbbcac02a477e8f05b095ee29b52b90d47421

1a70f4eef11fbecb721b9bab1c9ff43a8c4cd7b2cafef08c033c77070c6fe069

a4069aa29628e64ea63b4fb3e29d16dcc368c5add304358a47097eedafbbb565

d535bdc9970a3c6f7ebf0b229c695082a73eaeaf35a63cd8a0e7e6e3ceb22795

FAFCD5404A992850FFCFFEE46221F9B2FF716006AECB637B80E5CD5AA112D79C

C20BABA26EBB596DE14B403B9F78DDC3C13CE9870EEA332476AC2C1DD582AA07

1845a910dcde8c6e45ad2e0c48439e5ab8bbbeb731f2af11a1b7bbab3bfe0127

44887125aa2df864226421ee694d51e5535d8c6f70e327e9bcb366e43fd892c1

a70af759e38219ca3a7f7645f3e103b13c9fb1db6d13b68f3d468b7987540ddf

96babe53d6569ee3b4d8fc09c2a6557e49ebc2ed1b965abda0f7f51378557eb1

1845a910dcde8c6e45ad2e0c48439e5ab8bbbeb731f2af11a1b7bbab3bfe0127

d0c1662ce239e4d288048c0e3324ec52962f6ddda77da0cb7af9c1d9c2f1e2eb

A4F0B68052E8DA9A80B70407A92400C6A5DEF19717E0240AC608612476E1137E

68A49D5A097E3850F3BB572BAF2B75A8E158DADB70BADDC205C2628A9B660E7A

88f26f3721076f74996f8518469d98bf9be0eaee5b9eccc72867ebfc25ea4e83

078163d5c16f64caa5a14784323fd51451b8c831c73396b967b4e35e6879937b

7a43789216ce242524e321d2222fa50820a532e29175e0a2e685459a19e09069

97931d2e2e449ac3691eb526f6f60e2f828de89074bdac07bd7dbdfd51af9fa0

ff7ad2376ae01e4b3f1e1d7ae630f87b8262b5c11bc5d953e1ac34ffe81401b5

64a0ab00d90682b1807c5d7da1a4ae67cde4c5757fc7d995d8f126f0ec8ae983

2814b33ce81d2d2e528bb1ed4290d665569f112c9be54e65abca50c41314d462

f51b3d054995803d04a754ea3ff7d31823fab654393e8054b227092580be43db

dfb5ba578b81f05593c047f2c822eeb03785aecffb1504dcb7f8357e898b5024

94bf0aba5f9f32b9c35e8dfc70afd8a35621ed6ef084453dc1b10719ae72f8e2

28c3c50d115d2b8ffc7ba0a8de9572fbe307907aaae3a486aabd8c0266e9426f

70bb799557da5ac4f18093decc60c96c13359e30f246683815a512d7f9824c8f

73a9a1e38ff40908bcc15df2954246883dadfb991f3c74f6c514b4cffdabde66

1d04e33009bcd017898b9e1387e40b5c04279c02ebc110f12e4a724ccdb9e4fb

7b9e12e3561285181634ab32015eb653ab5e5cfa157dd16cdd327104b258c332

70EE22D394E107FBB807D86D187C216AD66B8537EDC67931559A8AEF18F6B5B3

8eb7e3e8f3ee31d382359a8a232c984bdaa130584cad11683749026e5df1fdc3

e4d6fe517cdf3790dfa51c62457f5acd8cb961ab1f083de37b15fd2fddeb9b8f

e86bb8361c436be94b0901e5b39db9b6666134f23cce1e5581421c2981405cb1

c733d85f445004c9d6918f7c09a1e0d38a8f3b37ad825cd544b865dba36a1ba6

28c3c50d115d2b8ffc7ba0a8de9572fbe307907aaae3a486aabd8c0266e9426f

514946a8fc248de1ccf0dbeee2108a3b4d75b5f6

b625cc9e4024d09084e80a4a42ab7ccaa6afb61d

3703374c9622f74edc9c8e3a47a5d53007f7721e

Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection

Hash 1:

sha256hash IN ("8eb7e3e8f3ee31d382359a8a232c984bdaa130584cad11683749026e5df1fdc3","d0c1662ce239e4d288048c0e3324ec52962f6ddda77da0cb7af9c1d9c2f1e2eb","28c3c50d115d2b8ffc7ba0a8de9572fbe307907aaae3a486aabd8c0266e9426f","1d04e33009bcd017898b9e1387e40b5c04279c02ebc110f12e4a724ccdb9e4fb","68A49D5A097E3850F3BB572BAF2B75A8E158DADB70BADDC205C2628A9B660E7A","64a0ab00d90682b1807c5d7da1a4ae67cde4c5757fc7d995d8f126f0ec8ae983","1845a910dcde8c6e45ad2e0c48439e5ab8bbbeb731f2af11a1b7bbab3bfe0127","1a70f4eef11fbecb721b9bab1c9ff43a8c4cd7b2cafef08c033c77070c6fe069","A4F0B68052E8DA9A80B70407A92400C6A5DEF19717E0240AC608612476E1137E","fba4883bf4f73aa48a957d894051d78e0085ecc3170b1ff50e61ccec6aeee2cd","4b036cc9930bb42454172f888b8fde1087797fc0c9d31ab546748bd2496bd3e5","18a507bf1c533aad8e6f2a2b023fbbcac02a477e8f05b095ee29b52b90d47421","a4069aa29628e64ea63b4fb3e29d16dcc368c5add304358a47097eedafbbb565","d535bdc9970a3c6f7ebf0b229c695082a73eaeaf35a63cd8a0e7e6e3ceb22795","FAFCD5404A992850FFCFFEE46221F9B2FF716006AECB637B80E5CD5AA112D79C","C20BABA26EBB596DE14B403B9F78DDC3C13CE9870EEA332476AC2C1DD582AA07","44887125aa2df864226421ee694d51e5535d8c6f70e327e9bcb366e43fd892c1","a70af759e38219ca3a7f7645f3e103b13c9fb1db6d13b68f3d468b7987540ddf","96babe53d6569ee3b4d8fc09c2a6557e49ebc2ed1b965abda0f7f51378557eb1","88f26f3721076f74996f8518469d98bf9be0eaee5b9eccc72867ebfc25ea4e83","078163d5c16f64caa5a14784323fd51451b8c831c73396b967b4e35e6879937b","7a43789216ce242524e321d2222fa50820a532e29175e0a2e685459a19e09069","97931d2e2e449ac3691eb526f6f60e2f828de89074bdac07bd7dbdfd51af9fa0","ff7ad2376ae01e4b3f1e1d7ae630f87b8262b5c11bc5d953e1ac34ffe81401b5","2814b33ce81d2d2e528bb1ed4290d665569f112c9be54e65abca50c41314d462","f51b3d054995803d04a754ea3ff7d31823fab654393e8054b227092580be43db","dfb5ba578b81f05593c047f2c822eeb03785aecffb1504dcb7f8357e898b5024","94bf0aba5f9f32b9c35e8dfc70afd8a35621ed6ef084453dc1b10719ae72f8e2","70bb799557da5ac4f18093decc60c96c13359e30f246683815a512d7f9824c8f","73a9a1e38ff40908bcc15df2954246883dadfb991f3c74f6c514b4cffdabde66","7b9e12e3561285181634ab32015eb653ab5e5cfa157dd16cdd327104b258c332","70EE22D394E107FBB807D86D187C216AD66B8537EDC67931559A8AEF18F6B5B3","e4d6fe517cdf3790dfa51c62457f5acd8cb961ab1f083de37b15fd2fddeb9b8f","e86bb8361c436be94b0901e5b39db9b6666134f23cce1e5581421c2981405cb1","c733d85f445004c9d6918f7c09a1e0d38a8f3b37ad825cd544b865dba36a1ba6")

Hash 2 :

sha1hash IN ("514946a8fc248de1ccf0dbeee2108a3b4d75b5f6","b625cc9e4024d09084e80a4a42ab7ccaa6afb61d","3703374c9622f74edc9c8e3a47a5d53007f7721e")

Reference:

https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-203a

#StopRansomware: Interlock

Summary

Indicators of Compromise (IOC) List

Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection

Tags

Comments

#StopRansomware: Interlock

Summary

Indicators of Compromise (IOC) List

Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection

Tags

Share This

Comments