Unwrapping the emerging Interlock ransomware attack
Summary: Interlock ransomware, first publicly reported in September 2024, gained access to a victim through a fake Google Chrome updater downloaded from a compromised legitimate news site, and Talos assesses the attacker remained in the environment for approximately 17 days before deploying the encryptor. The group runs a data leak site called "Worldwide Secrets Blog," targets healthcare, technology, U.S. government and European manufacturing opportunistically, and Talos assesses with low confidence that it emerged from Rhysida operators or developers based on code overlaps and shared tools including AnyDesk, PuTTY and AzCopy.
Key Takeaway: Seventeen days of dwell time elapsed between a single fake browser update and encryption, during which the attacker disabled EDR on some servers, deleted event logs, and moved data to attacker-controlled Azure storage with AzCopy - and the ransom note gives victims 96 hours before data is published and media are notified.
Read the original at Cisco Talos ↗
- Topics
- Ransomware
- Related
- How adversaries use politics for compromise Cyber Risks ·Wasted Locker Goes "Big-Game Hunting" in 2020 Cyber Risks ·