Classification: TLP:CLEAR | Publication Date: 2026-11-12 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

INTERLOCK Ransomware Gang: 12 New Leak-Site Listings in 48 Hours — Education & Healthcare Claims Analysis and Detection Rules

Executive Summary

Between 2026-11-10 and 2026-11-11, the INTERLOCK ransomware operation listed 12 organizations on its dark web leak site, one of the heaviest two-day posting bursts we have observed from this crew. The claims skew sharply toward K-12 education (6 of 12 listings) and healthcare (3 of 12), with additional listings in retail/e-commerce and food production. All claimed organizations are in the United States or Canada.

Every listing in this batch is single-source — observed by one leak-site crawler only — and a leak-site posting is a claim by a criminal actor, not a confirmed breach. However, the sector pattern itself is operationally meaningful independent of any individual claim's veracity: INTERLOCK is advertising a deliberate K-12 and healthcare focus in North America, and organizations in those verticals should treat this bulletin as a trigger for the detection and hardening actions below.

Named in this batch: Garden Valley School Division, Madison Honda, Custom Floors Unlimited, Meadows Valley School District, Ridgway High School, Southwest Orthopedic & Reconstructive Specialists, Indiana Area School District, Jerome School District, Assiniboine Dental Group, Elmcrest Children's Center, Inc, Conecuh Sausage Company Inc, and Richmond Public Schools. In each case, INTERLOCK claims to have compromised the organization; no listing in this dataset confirms an intrusion occurred.

Sourcing & Verification

• Corroboration: 0 of 12 listings were independently observed by a second leak-site crawler; all 12 appear on a single source (ransomware.live) only. Single-source means no second crawler has even confirmed the posting exists on the gang's site.
• What a listing means: Inclusion reflects the threat actor's claim and is not confirmation of a breach. No corroboration tier in this data — including multi-source — confirms a breach occurred. Only the named organization or its regulator can do that.
• Disputes and denials: A named organization may dispute the listing. A denial is likewise not proof the claim is false — disclosure obligations vary by jurisdiction and sector, and not every incident is reportable. Neither silence nor denial settles the question.
• Corrections: Security Arsenal will publish corrections to this briefing and welcomes contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — INTERLOCK

Aliases / branding: INTERLOCK operates a data leak site commonly referred to as the "Worldwide Secrets Blog." The group emerged in late 2024 and has been persistent through 2025–2026, with no reliable public attribution to a prior brand.

Operating model: Assessed as a closed or semi-closed group rather than a broad RaaS program — there is little evidence of a large affiliate ecosystem, consistent with the relatively curated, burst-pattern posting cadence we observe. Operators appear to handle intrusion, exfiltration, and negotiation in-house or with a small trusted circle.

Ransom demands: Not publicly standardized. Based on the victim profile (mid-market and public-sector entities), demands are assessed to scale to victim size, typically in the hundreds of thousands to low millions of USD. School districts and small healthcare providers are frequently negotiated down or published when payment is impossible — consistent with the number of under-resourced public entities in this batch.

Initial access methods (historical TTPs):

• Social-engineered execution via ClickFix/FileFix-style lures — fake browser updates, fake CAPTCHA "verification" prompts, and fake error dialogs that trick users into pasting malicious PowerShell into Run/Terminal. This is the group's signature access technique and has been used to deliver the NodeSnake JavaScript-based backdoor attributed to their operations.
• Compromised or brute-forced remote access — exposed RDP and edge VPN appliances.
• Malvertising and SEO-poisoned downloads of legitimate IT tools bundled with loaders.

Extortion model: Double extortion — data theft followed by encryption, with leak-site publication as leverage. The batch analyzed here is the "publish" phase of that playbook.

Dwell time: Reporting on INTERLOCK intrusions suggests short-to-moderate dwell times, often days rather than weeks — the group moves quickly from access to staging once a foothold is established, which compresses the defender's detection window and makes pre-encryption alerting the decisive control.

Current Campaign Analysis

Sector targeting

From the 12 claimed listings:

Half the batch is K-12. This is a rational target selection: school districts hold sensitive minors' data (high coercive value), operate chronically under-resourced security programs, and face public pressure that gangs exploit during negotiation.

Geographic concentration

US (10 of 12) and Canada (2 of 12). Consistent with INTERLOCK's historical North American focus.

Victim profile

The claimed organizations cluster in the small-to-mid-market band: independent school districts, regional specialty medical practices, a dental group, a children's services nonprofit, a regional auto dealer, a flooring retailer, and a regional food manufacturer. Estimated revenue/operating budgets are roughly $5M–$250M — the classic "big enough to pay, small enough to lack a 24/7 SOC" band that mid-tier ransomware crews farm deliberately.

Posting frequency / escalation pattern

11 of the 12 listings were published on a single date (2026-11-10), with one (Garden Valley School Division) on 2026-11-11. Bulk same-day publication typically indicates either (a) a batch of stalled negotiations dumped at once as pressure, or (b) a maturation pipeline of intrusions reaching the publish stage simultaneously. Either interpretation implies upstream intrusion activity in the preceding 2–6 weeks that defenders in these sectors may still have in-progress.

CVE linkage (hypothesis only)

We have no evidence linking any named listing above to a specific CVE. At the sector-exposure level, INTERLOCK's known preference for edge-device and remote-access access paths makes the following CISA KEV entries relevant hypothesis-space for their intrusion set — and for any organization in the targeted verticals:

• CVE-2026-50751 — Check Point Security Gateway improper authentication (IKEv1): direct unauthenticated edge access; prime initial-access candidate for groups that favor appliance exploitation.
• CVE-2026-20316 — Cisco Secure FMC hard-coded password: management-plane compromise of the firewall stack itself.
• CVE-2026-59310 — VMware vCenter path traversal: high value post-access — vCenter control enables mass hypervisor encryption, the highest-impact ransomware detonation point.
• CVE-2026-63077 — JetBrains TeamCity deserialization: CI/CD compromise; K-12 and mid-market environments with self-hosted build infrastructure are exposed here.
• CVE-2026-48027 — Nx Console embedded malicious code: developer-workstation supply-chain vector, consistent with the group's social-engineering-oriented tooling.

Actionable framing: if you are in education or healthcare in the US/CA, assume these KEV items are being scanned against your perimeter regardless of which gang is running the scanner.

Detection Engineering

The following detections target INTERLOCK's documented playbook: ClickFix-style user-executed PowerShell, NodeSnake-style JS staging, and pre-encryption data staging/deletion of recovery options.

---
title: INTERLOCK ClickFix Pattern - Suspicious PowerShell Spawned from Browser or Run Dialog
description: Detects PowerShell launched by browsers or explorer (Run dialog), a hallmark of ClickFix/FileFix fake-CAPTCHA lures used by INTERLOCK to deliver NodeSnake.
logsource:
  category: process_creation
  product: windows
  definition: 'Requirements: Sysmon or equivalent command-line auditing'
detection:
  sel_parent:
    ParentImage|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\brave.exe'
      - '\explorer.exe'
  sel_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\mshta.exe'
      - '\wscript.exe'
      - '\cscript.exe'
  filter_softwarecenter:
    ParentCommandLine|contains:
      - 'CCMExec'
      - 'SoftwareCenter'
  condition: sel_parent and sel_child and not filter_softwarecenter
falsepositives:
  - Rare admin workflows; software distribution tools
level: high
tags:
  - attack.initial_access
  - attack.t1204
  - attack.t1059.001
  - group.interlock
status: experimental
date: 2026/11/12
---
title: INTERLOCK Pre-Encryption - VSS Deletion and Backup Tampering
description: Detects Volume Shadow Copy deletion, boot configuration tampering, and backup catalog deletion performed in the minutes before ransomware detonation.
logsource:
  category: process_creation
  product: windows
detection:
  sel_vssadmin:
    Image|endswith: '\vssadmin.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'resize shadowstorage'
  sel_bcdedit:
    Image|endswith: '\bcdedit.exe'
    CommandLine|contains:
      - 'recoveryenabled'
      - 'bootstatuspolicy'
  sel_wbadmin:
    Image|endswith: '\wbadmin.exe'
    CommandLine|contains:
      - 'delete catalog'
      - 'delete systemstatebackup'
  condition: 1 of sel_*
falsepositives:
  - Legitimate storage admin maintenance (rare on endpoints; correlate with change windows)
level: critical
tags:
  - attack.impact
  - attack.t1490
  - group.interlock
status: experimental
date: 2026/11/12
---
title: INTERLOCK Exfiltration Staging - Archiving Utility on Sensitive Directories
description: Detects mass archive creation against user data, shares, or document paths using common exfil archivers, consistent with INTERLOCK double-extortion staging.
logsource:
  category: process_creation
  product: windows
detection:
  sel_archiver:
    Image|endswith:
      - '\rar.exe'
      - '\7z.exe'
      - '\winrar.exe'
      - '\7za.exe'
  sel_targets:
    CommandLine|contains:
      - 'Documents'
      - 'Shared'
      - 'Finance'
      - 'HR'
      - 'payroll'
      - '\\'  # UNC paths to network shares
  condition: sel_archiver and sel_targets
falsepositives:
  - Backup scripts; IT packaging — baseline and allowlist known scheduled tasks
level: high
tags:
  - attack.collection
  - attack.t1560.001
  - attack.exfiltration
  - group.interlock
status: experimental
date: 2026/11/12

// INTERLOCK hunt: pre-ransomware staging chain within a 60-minute window
// Looks for the kill-chain ordering: VSS deletion -> mass file read/copy -> archive creation -> suspicious service/tool execution
let window = 60m;
let vssEvents =
    DeviceProcessEvents
    | where TimeGenerated > ago(7d)
    | where (FileName =~ "vssadmin.exe" and ProcessCommandLine has_any ("delete shadows", "resize shadowstorage"))
        or (FileName =~ "bcdedit.exe" and ProcessCommandLine has_any ("recoveryenabled", "ignoreallfailures"))
        or (FileName =~ "wbadmin.exe" and ProcessCommandLine has "delete")
    | project VssTime=TimeGenerated, DeviceId, DeviceName, VssCmd=ProcessCommandLine, InitiatingAccount=InitiatingProcessAccountName;
let archiveEvents =
    DeviceProcessEvents
    | where TimeGenerated > ago(7d)
    | where FileName in~ ("rar.exe", "7z.exe", "7za.exe", "winrar.exe", "robocopy.exe")
    | where ProcessCommandLine has_any ("Documents", "Shared", "Finance", "HR", "\\")
    | project ArchiveTime=TimeGenerated, DeviceId, ArchiveCmd=ProcessCommandLine;
let remoteExecEvents =
    DeviceProcessEvents
    | where TimeGenerated > ago(7d)
    | where FileName in~ ("psexec.exe", "psexesvc.exe", "wmic.exe")
        or (FileName =~ "powershell.exe" and ProcessCommandLine has_any ("Invoke-Command", "Enter-PSSession", "New-PSSession"))
    | project RemoteTime=TimeGenerated, DeviceId, RemoteCmd=ProcessCommandLine;
vssEvents
| join kind=inner archiveEvents on DeviceId
| where ArchiveTime between (VssTime .. (VssTime + window))
| join kind=leftouter remoteExecEvents on DeviceId
| project DeviceName, InitiatingAccount, VssTime, VssCmd, ArchiveTime, ArchiveCmd, RemoteTime, RemoteCmd
| sort by VssTime desc;

# INTERLOCK rapid triage: run on any suspected host or via fleet deployment
# Checks: shadow copy tampering, new scheduled tasks (7d), persistence run keys, RDP exposure, suspicious unsigned binaries in user dirs
$report = @{} ; $cutoff = (Get-Date).AddDays(-7)

# 1. Volume Shadow Copies - flag if zero exist or were deleted recently
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
$report["ShadowCopyCount"] = ($shadows | Measure-Object).Count
$report["RecentShadowDeletes"] = Get-WinEvent -FilterHashtable @{LogName='System'; Id=410; StartTime=$cutoff} -ErrorAction SilentlyContinue |
    Select-Object TimeCreated, Message

# 2. Scheduled tasks created in last 7 days (ransomware persistence/lateral tasking)
$report["NewScheduledTasks"] = Get-ScheduledTask | ForEach-Object {
    $info = $_ | Get-ScheduledTaskInfo -ErrorAction SilentlyContinue
    [PSCustomObject]@{ Name=$_.TaskName; Path=$_.TaskPath; Author=$_.Author; LastRun=$info.LastRunTime }
} | Where-Object { $_.Path -notlike '\Microsoft\*' }

# 3. Run-key persistence
$report["RunKeys"] = @(
    'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
    'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run'
) | ForEach-Object { Get-ItemProperty -Path $_ -ErrorAction SilentlyContinue } |
    Select-Object * -ExcludeProperty PS*

# 4. RDP exposure: enabled + NLA status + listening port
$ts = Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server'
$report["RDPEnabled"] = ($ts.fDenyTSConnections -eq 0)
$report["RDPNLARequired"] = ((Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication -ErrorAction SilentlyContinue).UserAuthentication -eq 1)
$report["RDPListening"] = (Get-NetTCPConnection -LocalPort 3389 -State Listen -ErrorAction SilentlyContinue) -ne $null

# 5. Unsigned executables dropped in user-writable paths in last 7 days (NodeSnake/loader staging)
$report["RecentUnsignedBins"] = Get-ChildItem "$env:LOCALAPPDATA","$env:APPDATA","$env:PUBLIC" -Recurse -Include *.exe,*.dll,*.js -ErrorAction SilentlyContinue |
    Where-Object { $_.LastWriteTime -gt $cutoff } |
    ForEach-Object {
        $sig = Get-AuthenticodeSignature $_.FullName
        if ($sig.Status -ne 'Valid') { [PSCustomObject]@{ Path=$_.FullName; Modified=$_.LastWriteTime; SigStatus=$sig.Status } }
    }

$report | ConvertTo-Json -Depth 4 | Out-File "$env:TEMP\interlock_triage_$(hostname)_$(Get-Date -Format yyyyMMdd_HHmm).json"
Write-Host "[+] Triage complete. Shadow copies: $($report['ShadowCopyCount']). Review JSON in %TEMP%." -ForegroundColor Cyan

Incident Response Priorities

T-minus detection checklist (before encryption fires)

INTERLOCK's short dwell time means these signals may be your only warning:

• Browser- or explorer-spawned PowerShell/mshta/wscript on any endpoint (ClickFix fingerprint — highest-fidelity early signal for this group)
• New or modified Volume Shadow Copy state, bcdedit changes, or wbadmin catalog deletion — encryption is likely minutes away
• Archive utility execution against document/share paths outside approved backup windows
• Unexpected PsExec/WMI/remote PowerShell sessions originating from a single workstation
• New scheduled tasks or run-key entries on servers, especially domain controllers and file servers
• Anomalous outbound traffic to file-sharing/megaupload destinations or unfamiliar VPS infrastructure

Assets this gang historically prioritizes for exfiltration

• Student and staff PII from SIS/HR systems (K-12 listings make this the highest-risk data class in the current campaign)
• Patient records and billing data (PHI) from EHR and practice-management systems
• Financial records, payroll files, W-2/1099 data
• Legal documents, contracts, and insurance correspondence (leverage material)
• Domain controller credential databases (ntds.dit) where reachable

Containment actions ordered by urgency

1. Isolate, don't power off, any host showing VSS-tampering or archive-staging behavior — memory holds the encryption keys and staging evidence.
2. Disable the implicated user account and force credential reset; ClickFix intrusions begin with a user-context foothold.
3. Block egress to known staging/file-hosting destinations at the proxy/firewall; kill active large transfers.
4. Disable SMB/RPC lateral paths from the affected segment (PsExec/admin$); pause all non-emergency remote administration tooling.
5. Snapshot and isolate hypervisor management planes (vCenter) — if CVE-2026-59310 is unpatched, assume management-plane targeting.
6. Verify offline/immutable backups are intact and recent before any negotiation or rebuild decision.
7. Engage counsel and cyber-insurance carrier early; the leak-site listing means a publication clock is already running.

Hardening Recommendations

Immediate (24 hours)

• Patch or mitigate the five KEV items above — CVE-2026-50751 (Check Point), CVE-2026-20316 (Cisco FMC), CVE-2026-59310 (vCenter), CVE-2026-63077 (TeamCity), CVE-2026-48027 (Nx Console). These are confirmed-exploited; sequencing starts at the perimeter.
• Deploy the ClickFix Sigma rule fleet-wide. INTERLOCK's signature lure is detectable with a single process-lineage rule. Also add a browser-policy block or endpoint control preventing paste-into-Run-dialog prompts from untrusted pages where feasible.
• Alert on all VSS/bcdedit/wbadmin destructive commands — treat as page-the-SOC critical.
• Disable Office macros from internet-sourced files and enforce Mark-of-the-Web handling (Mark of the Web zone stripping is a common loader bypass — verify it isn't being stripped by archivers).
• Lock down RDP: disable where unused, require NLA + VPN, and alert on external RDP attempts against education/healthcare segments.
• User warning blast (especially K-12 staff): no legitimate website will ever ask you to press Win+R and paste a command to "verify you're human."

Short-term (2 weeks)

• Segment student/curriculum networks from administrative and finance systems in school districts; segment clinical systems from business networks in healthcare.
• Implement immutable/offline backup tiers with a tested restore runbook — assume the primary backup catalog will be targeted for deletion.
• Application control (WDAC/AppLocker) blocking user-writable-path script and binary execution; this directly blunts NodeSnake-style JS staging from %LOCALAPPDATA%.
• Egress filtering with destination categorization and alerting on bulk transfers to consumer file-hosting services.
• Managed detection coverage for off-hours: this batch's bulk publication pattern indicates intrusions that ran to completion without interruption — overnight and weekend detection gaps are the enabler.
• vCenter and CI/CD isolation: management planes on dedicated, MFA-gated, non-domain-joined access paths.

Bottom Line

All 12 listings are unverified, single-source criminal claims — and may remain so. But a gang that can name six K-12 districts and three healthcare providers in one 48-hour burst is telling you where its intrusion pipeline is pointed. North American education and healthcare organizations should treat INTERLOCK's ClickFix initial-access pattern and VSS-destruction detonation sequence as live risks this week, patch the five KEV items, and deploy the detections above before the next posting wave includes an organization whose claim turns out to be true.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub