Interlock ransomware gang creates volatile situation

In March 2026, the Sophos Emergency Incident Response (EIR) team investigated an incident in which we observed the use of the legitimate IR memory analysis tool Volatility3 by the ransomware threat actor Interlock. Use of legitimate tools in attacks such as these continues an unfortunate trend we first noted last year.

Interlock, which Sophos Counter Threat Unit (CTU) researchers track as GOLD EMBRACE, emerged in September 2024. It has been spotted worldwide but currently focuses on North American and European targets in the critical infrastructure, healthcare, and education sectors. It practices double extortion -- stealing sensitive data before encrypting systems, then threatening to leak information on its "Worldwide Secrets Blog" if its demands are not met. Rather than operating as Ransomware-as-a-Service, Interlock appears to be the handiwork of a small, dedicated team of operators that develops its own malware and conducts its own attacks. 

Noteworthy tactics, techniques, and procedures (TTPs) include the use of ClickFix-style social-engineering methods, a custom-built remote-access trojan (RAT) called "NodeSnake" or (alternately) "Interlock RAT," and a PHP-based backdoor for cross-platform persistence (in addition to targeting of Windows and FreeBSD systems). More recently, Interlock has been actively exploiting CVE-2026-20131, a critical-severity zero-day vulnerability in Cisco Secure Firewall Management Center (FMC) Software. 

Activity overview

The adversary’s Volatility3 activity occurred on the customer’s Patient Zero device (that is, the first system the threat actor was able to compromise to establish a foothold in the target’s environment) prior to the start of our engagement. The customer’s environment comprises both Sophos-managed servers and (at the time) Defender-managed endpoints, though it was discovered that not all endpoints were in fact running protection of any sort. Patient Zero was a Defender-managed endpoint running Windows 10.

On that machine, we observed credential access-related activity to extract NTLM hashes, LM hashes (legacy hashes if enabled), and user account information via this command: 

• vol.exe -f .\mem.raw windows.hashdump.Hashdump 

In a legitimate use scenario, use of this command could be expected as part of a DFIR investigation, a security assessment, or malware analysis. However, adversarial use of Volatility3 would leave similar traces. In this situation, the customer knew of no legitimate Volatility3 use on their system.

The team also observed the following command:

• vol.exe -f .\mem.raw windows.cachedump.Cachedump

This command attempts to extract cached domain credentials from memory -- username and hash pairs, as well as information on previously logged-in domain users.

We also saw the threat actor use WinPmem, a legitimate physical memory acquisition tool made by Velocidex (the company originally behind Velociraptor, now owned by Rapid7), to collect the memory capture:

• winpmem_mini_x64_rc2.exe mem.raw

Diary of an attack chain

The interval between initial access and lateral movement to the domain controller in this case took slightly over 26 hours – longer than average, but not much time at all in human terms. Interestingly, as we see below, the attacker took a 24-hour break before redoubling the effort – basically, establishing persistence on the Patient Zero machine, putting a pin in it, and circling back with a fresh plan of attack the next day. 

Initial Access | T1189 - Drive-by Compromise

On Day 1 of the attack, an end-user device was linked by a ChatGPT search for Dynamics 365 to a reputable web property that is believed to have been compromised at the time with a ClickFix lure. The end user was seeking a legitimate software application at the time, much as we have seen in other cases using ClickFix-style luring.

• hxxps[://]www[.]redacted[.]com/dynamics-365-business-central-capabilities/?utm_source=chatgpt[.]com

At the start of the attack (00d 00:00:00), the end-user device connected to a web host with a malicious reputation at remote IP 64.95.11.22, resolving to voginc[.]com. The web host for that address is BL Networks, also known as BLNWX or BitLaunch, which is registered as a business in Sheridan, Wyoming. Curiously, it shares its business address with one company registered with the Wyoming Secretary of State as C2 Operations (America) Inc. and one called C2, LLC – two among many thousands of companies represented by “registered agents” at that address.

At 00d 00:00:05 (that is, five seconds in), evidence of ClickFix was identified when the clipboard contents of the end-user device were read via an API call.

At 00d 00:00:13, the threat actor engaged in a bit of social engineering, convincing the user to paste a certain command into a Run dialogue box. This executed a command via termina    l on the end-user device to establish persistence by first downloading PowerShell code from domain afshapiro[.]com. This second-stage PowerShell command used curl to retrieve a RAT payload from 104.236.109.139 and installed the payload to run at startup. We noted an interesting evasion technique in that first, hand-pasted command – it used PowerShell, but did so by specifying the path where PowerShell is located and using a wildcard match to get there in order to avoid detection.

Persistence | T1547.001 - Boot or Logon Autostart Execution:Registry Run Keys / Startup Folder

At 00d 00:25:41, the threat actor installed a malicious command into the Auto-Start Extensibility Points (ASEP) registry to run at startup, in order to maintain persistence on the device.

Discovery | T1069.002 - Permission Groups Discovery:Domain Groups

On Day 2, the threat actor executed an LDAP (Lightweight Directory Access Protocol) query on the end-user device. The structural information provided by LDAP queries would provide the road map for privilege elevation in the next step and, later, for asset acquisition. 

Privilege Escalation | T1055.002 - Process Injection:Portable Executable Injection

At 01d 00:37:29, the threat actor leveraged access to the end-user device to execute malicious payload zoom.txt, leveraging a trusted Microsoft process to run the arbitrary code. Threat actors use kernel exploits to elevate the security privileges of running processes. With elevated privileges, the affected process might now be able to access sensitive files, ensure persistence, and modify system settings.

Privilege Escalation | T1134.003 - Access Token Manipulation:Make and Impersonate Token

At 01d 00:58:22, the threat actor queried a server principal name (SPN), indicating execution of a Kerberoasting attack from the end-user device to escalate privileges to the domain. This is a post-exploitation technique used to obtain credentials for a service account from Active Directory Domain Services (AD DS). To conduct this attack, attackers request a Kerberos service ticket — known as a ticket granting service (TGS) — using a valid domain user’s TGT (ticket-granting ticket) for a specified SPN that has the privileges the attackers are seeking. This usually involves previous LDAP querying of AD DS for these accounts. For instance, an attacker might be trying to identify the passwords associated with the accounts, which can then be used to move laterally and access resources within the organization, as seen in the following step.

Lateral Movement | T1021.001 - Remote Services:Remote Desktop Protocol

At 01d 02:19:39, the threat actor moved laterally from the end-user device to a domain controller, leveraging anonymous login to perform a downgrade attack using NTLM.

Persistence | T1053.005 - Scheduled Task/Job:Scheduled Task

On Day 3, the threat actor, using the compromised domain administrator account, executed the following command line instruction on a print server to create a scheduled task which executed persistence malware debug.log via node.exe:

• Task: \Microsoft\Windows\Defrag\ScheduledDefrags
• Command: "C:\Windows\system32\schtasks.exe" /create /sc DAILY /tn \Microsoft\Windows\Defrag\ScheduledDefrags /tr "C:\Windows\system32\config\systemprofile\AppData\Roaming\node-v22.11.0-win-x64\node.exe C:\Windows\system32\config\systemprofile\AppData\Roaming\node-v22.11.0-win-x64\debug.log" /st 23:30 /ru system

At this point, and for the next several days until the incident was brought to our attention and contained, the threat actor was off to the races. We found evidence of credential dumping (including AWS credentials), access to sensitive files, addition of new domain-admin accounts, tampering with Defender on the endpoints, and more. Ultimately, data was indeed exfiltrated and the customer was locked out of their hypervisors.

Protections and mitigations

The IOCs relevant to this incident are covered as follows and are available in .csv format on our Github:

The afshapiro[.]com repository mentioned above has been taken offline since the events covered in this post. 

Our Application Control Policy includes Volatility, and customers can choose whether Volatility activity is or is not permitted on their managed devices. In addition, Sophos has a detection that would have spotted the Kerberoasting activity had the originating device been running Sophos protections (as mentioned above, the endpoints were running a different product at the time of the incident; the activity occurred on the endpoint machine). We encourage all readers, regardless of the security products they use, to confirm that endpoint detection services are present on all servers and endpoints, and that the service is properly installed and configured.

At the outset of the investigation, the customer’s IT team believed that backups were available to restore the affected systems. This proved not to be the case. The organization also lacked up-to-date network documentation and a complete inventory of its IT assets, making it difficult to establish what should have been present in the virtual environments managed by the affected hypervisors. Such documentation wouldn’t have prevented the attack from occurring, but it would have made mitigation and a return to normal far easier and faster. 

Likewise, it’s important to do regular policy audits; even the best-designed application-control policies need upkeep. These boring-but-important oversight tasks allow for faster mitigation efforts when trouble comes, may help accelerate the organization’s return to normal operations.

Conclusion

For this customer, the uproar and disruption of this attack led to a switch to Sophos’ endpoint protection, and to a rebuild for their virtual environment (from which they remained locked out, making a rebuild unavoidable). Since their Active Directory environment was heavily affected, they also decided to move that system over to Entra (Azure AD), with all that entails.

Interlock has evolved since mid-2024 into a multi-skilled threat increasingly willing to adapt its techniques and seek large targets. The operators have been fairly aggressive about incorporating new techniques and abusing fresh vulnerabilities – evidence shows Interlock was making use of the CVE-2026-20131 Cisco zero-day a full two weeks before Cisco acknowledged it. The adoption of legitimate tools such as Volatility3 and WinPmem shows that this threat’s evolution continues.

Acknowledgements

Robert Weiland, AJ Raiola, Nigel Weber, Louai Abboud, and Andrew Ludgate contributed insights to this report. Special thanks to the Sophos DFIR team; the comradeship and collaboration efforts involving this investigation were tremendous.