What is Interlock ransomware and how does it attack Windows and Linux systems?
Interlock ransomware is a newly identified threat using double extortion tactics and targeting both Windows and Linux systems, particularly virtual machines. Discovered in late 2024, it spreads through drive-by downloads from compromised legitimate websites and utilizes tools like AnyDesk, PSExec, and Cobalt Strike for lateral movement and encryption. A notable feature of Interlock is its deceptive ClickFix technique, which tricks users with fake CAPTCHA prompts to trigger malware. CISA, FBI, and HHS have issued urgent mitigation guidelines, urging organizations to deploy EDR, enforce segmentation, and educate employees to combat this growing ransomware threat.
Quick answer: Interlock is a ransomware group first seen in September 2024, with attacks across North America and Europe. It uses double extortion, stealing data before encrypting it, and targets both Windows and Linux systems. CISA and the FBI also describe ClickFix social engineering as a way in. Patch, segment networks and keep backups.
Key takeaways
- Interlock was first seen in September 2024 and uses double extortion on Windows and Linux.
- CISA and the FBI describe ClickFix social engineering as a way in.
- Patch, segment the network and keep offline backups.
Table of Contents
- What Is Interlock Ransomware?
- Who Is Being Targeted?
- How Double Extortion Works
- Cross-Platform Attacks: Windows and Linux
- Innovative Social Engineering: The ClickFix Tactic
- Tools Used by Interlock Ransomware
- Critical Infrastructure Is At High Risk
- CISA and FBI Recommended Mitigation Strategies
- Connection to Rhysida Ransomware?
- Interlock Ransomware Overview
- Conclusion
The Cybersecurity and Infrastructure Security Agency (CISA), along with the FBI, Department of Health and Human Services (HHS), and MS-ISAC, has issued an urgent joint advisory about the Interlock ransomware group. This new ransomware strain is gaining notoriety for double extortion tactics and cross-platform attacks on Windows and Linux systems.
What Is Interlock Ransomware?
Interlock ransomware is a new cyber threat that emerged in September 2024 and has since been linked to attacks across North America and Europe. Unlike traditional ransomware, Interlock uses drive-by downloads from compromised legitimate websites to gain access, a rare and stealthy technique that bypasses common detection mechanisms.
Who Is Being Targeted?
Interlock doesn't target specific industries. Instead, its operators are opportunistic and financially motivated, choosing victims based on system vulnerabilities and ease of compromise, not sector.
Sectors Impacted:
-
Healthcare
-
Finance
-
Manufacturing
-
Education
-
Government
-
Critical Infrastructure
How Double Extortion Works
Interlock uses double extortion to increase pressure on victims:
-
Encryption: Files and systems are locked.
-
Exfiltration: Sensitive data is stolen and threatened with public exposure on their dark web leak site.
This tactic puts victims in a difficult position, pay the ransom or face reputational damage, regulatory penalties, and data exposure.
Cross-Platform Attacks: Windows and Linux
A major concern is that Interlock targets both Windows and Linux, especially virtual machines in hybrid environments. This cross-platform encryption capability makes the malware highly adaptable and dangerous for modern IT infrastructures.
Innovative Social Engineering: The ClickFix Tactic
Interlock introduces a new social engineering method called ClickFix, where users are tricked into clicking fake CAPTCHA prompts that appear to resolve system errors. In reality, these clicks trigger the malware payload execution.
This evolution mirrors past techniques but reflects a growing sophistication in user deception.
Tools Used by Interlock Ransomware
| Tool Name | Description |
|---|---|
| AnyDesk | Remote access software used for file transfers and persistence. |
| Cobalt Strike | Penetration testing tool repurposed for post-exploitation control. |
| PowerShell | Scripting tool for automating malicious tasks across platforms. |
| PSExec | Executes commands on remote systems to spread laterally. |
| PuTTY.exe | SSH client to connect to systems and exfiltrate data. |
| ScreenConnect | Remote access software, often used in cracked form by attackers. |
| SystemBC | Proxy and command & control tool used to hide C2 communication. |
| conhost.exe | Windows Console Host used in running background commands. |
| WinSCP | Secure file transfer client using SFTP and FTP. |
Critical Infrastructure Is At High Risk
The ransomware’s focus on encrypting virtual machines has already impacted multiple critical sectors. Future variants may escalate to physical servers and individual workstations, increasing the threat level even further.
CISA and FBI Recommended Mitigation Strategies
To reduce exposure to Interlock ransomware, CISA recommends:
-
Deploying Endpoint Detection and Response (EDR) systems
-
Applying DNS filtering and Web Application Firewalls (WAF)
-
Implementing Network Segmentation
-
Conducting regular employee training on phishing and social engineering
-
Keeping systems updated and patching vulnerabilities promptly
Connection to Rhysida Ransomware?
Ongoing FBI investigations have found similarities between Interlock and Rhysida ransomware, suggesting either shared resources or a possible evolution of an older threat group.
Interlock Ransomware Overview
| Aspect | Details |
|---|---|
| Initial Access | Drive-by download from compromised sites |
| Extortion Tactic | Double extortion (encryption + data leak threat) |
| Target OS | Windows and Linux (focus on virtual machines) |
| Delivery Method | ClickFix: fake CAPTCHA trick |
| Victim Profile | Opportunistic (no specific industry focus) |
| Tools Used | AnyDesk, Cobalt Strike, PSExec, PowerShell, PuTTY, ScreenConnect, etc. |
| Mitigation Advice | EDR, WAF, DNS filtering, segmentation, patching, social engineering training |
Conclusion: Stay Vigilant
The Interlock ransomware campaign highlights the evolving nature of ransomware in 2026, cross-platform, socially engineered, and financially driven. Organizations must prioritize proactive defense, incident response planning, and employee awareness to stay resilient.
To take this further with guided labs and an instructor, see our SOC analyst exam preparation.
Related reading
Frequently Asked Questions
What's Your Reaction?
Like
0
Dislike
0
Love
0
Funny
0
Wow
0
Sad
0
Angry
0
Vaishnavi is a skilled tech professional at the Ethical Hacking Training Institute in Pune, responsible for managing and optimizing the technical infrastructure that supports advanced cybersecurity education. With deep expertise in network security, backend operations, and system performance, she ensures that practical labs, online modules, and assessments run smoothly and securely. Her behind-the-scenes contributions play a vital role in delivering a seamless and secure learning experience for aspiring ethical hackers.
![Top 10 Famous Ethical Hackers in India [Updated 2026]](https://www.webasha.com/blog/uploads/images/202608/image_140x98_da23f65c290cfbf1237d77aec58a2f0f.jpg)