campaign · 1753142400000

Interlock Ransomware Campaign Targets Critical Infrastructure

U.S. agencies documented Interlock ransomware operations using drive-by downloads and ClickFix social engineering against organizations in North America and Europe.

What happened

CISA, the FBI, HHS, and MS-ISAC published a joint advisory describing Interlock ransomware targeting businesses and critical infrastructure. The actors used fake browser updates, deceptive verification prompts, remote-access tools, and data theft before encryption.

Technical mechanism

The campaign used drive-by downloads and ClickFix-style social engineering to trigger malicious PowerShell or payload execution, followed by persistence, credential access, remote control, lateral movement, data exfiltration, and ransomware deployment.

Why it matters

Interlock demonstrated the evolution of ransomware access methods toward convincing browser-update and verification lures combined with remote-access tooling and double extortion.

Impact

Victims in multiple sectors faced operational disruption, data theft, and extortion. The campaign affected both Windows and Linux environments, including virtualized infrastructure.

Response

The joint advisory supplied indicators, observed tactics, and mitigations focused on web filtering, application control, endpoint monitoring, identity protections, segmentation, and tested recovery.

Defensive lessons

  • Train users and controls to recognize ClickFix and fake browser-update execution lures
  • Restrict script execution and monitor unexpected PowerShell or remote-access tools
  • Protect virtualization and backup infrastructure from ordinary domain compromise

Evidence register

  1. CISA, FBI, HHS, and MS-ISAC — #StopRansomware: Interlock (verified)