INTERLOCK Ransomware Gang: Education & Municipal Government Hits Posted — Campaign Analysis & Detection Rules

INTERLOCK is a relatively young but aggressive ransomware operation that surfaced publicly in late 2024 and has matured rapidly into one of the more methodical double-extortion crews operating against US organizations. Unlike volume-driven Ransomware-as-a-Service (RaaS) brands such as LockBit or Akira, INTERLOCK appears to operate as a closed or semi-closed group with a small affiliate pool — there is no public recruitment chatter matching the scale of established RaaS programs, and victim postings show consistent tradecraft rather than the noisy variance typical of open affiliate models.

Aliases and tooling: INTERLOCK does not have widely adopted aliases, but incident responders have tied their intrusions to commodity loaders including BumbleBee and SystemBC-style proxies, and post-compromise beacons consistent with Cobalt Strike. Some reporting associates their delivery chains with fake browser update lures (SocGholish-style drive-by) and trojanized IT utility installers.

Ransom demands: Demands observed in negotiations typically range from the low six figures to approximately $1.5M USD, scaled to victim revenue and insurance posture. Demands against public-sector entities tend to sit at the lower end of that band but carry a higher leak-follow-through rate, since municipalities and school districts rarely pay.

Initial access methods (observed):

• SocGholish/fake-update drive-by downloads delivering JS/HTA loaders
• Phishing with malicious attachments leading to loader deployment
• Exploitation of internet-facing remote access infrastructure (VPN concentrators, firewalls) — consistent with the perimeter-device CVE pattern below
• Exposed or weakly authenticated RDP in some intrusions

Double extortion: Standard double-extortion model — data is staged and exfiltrated (frequently to MEGA or attacker-controlled infrastructure via Rclone/FileZilla) before encryption, and victims who refuse to pay are posted to the gang's dedicated leak site with staged data releases.

Dwell time: Estimated 5–14 days from initial access to detonation in most investigated incidents, with exfiltration typically occurring 24–72 hours before encryption. That window is your detection opportunity.

Current Campaign Analysis

Victims posted (2026-09-15)

Sector and geographic concentration

Both victims are US public-sector organizations — a K-12 school district and a municipal government. This is a deliberate target selection, not opportunistic scatter. Public education and municipal government share traits INTERLOCK appears to favor: under-resourced security teams, heavy reliance on managed service providers and remote access tooling, aging perimeter devices, and cyber insurance policies that make payment at least plausible. School districts in particular hold dense PII (student records, staff SSNs, health information) that maximizes extortion leverage even when systems are recoverable from backup.

Victim profile

• Size range: Small-to-midsize public entities — typically 500–5,000 endpoints, annual budgets in the $50M–$500M range
• Revenue/budget estimates: Municipal governments of Fort Smith's size operate ~$100M–$200M budgets; mid-size school districts similar. INTERLOCK calibrates demands to these figures
• Common stack: VMware vSphere environments, Cisco or Check Point perimeter devices, Microsoft 365 hybrid identity, and ConnectWise ScreenConnect or similar RMM tooling managed by third-party MSPs

Posting frequency / escalation

Two simultaneous same-day postings indicate INTERLOCK is batch-processing intrusions — likely running parallel access operations and staging multiple victims before publishing. Two victims per cycle is consistent with a small-team, high-touch operation rather than RaaS-scale volume, but the same-day pair suggests operational tempo is increasing into Q4 2026.

Initial access vector hypothesis — KEV correlation

The actively exploited CVEs in the current threat picture map directly onto INTERLOCK's observed target profile:

• CVE-2026-20316 (Cisco FMC hard-coded password) and CVE-2026-50751 (Check Point IKEv1 improper auth) — perimeter security appliances are classic INTERLOCK entry points; a compromised firewall management plane gives both access and visibility into the victim's defensive stack
• CVE-2026-59310 (VMware vCenter path traversal) — post-access, vCenter compromise enables direct access to virtualized infrastructure for mass encryption and destruction of backup VMs
• CVE-2024-1708 (ConnectWise ScreenConnect) — still being exploited two years post-disclosure; RMM compromise against MSP-managed small public entities is a direct pipeline to exactly the victim type in this campaign
• CVE-2026-50751 and CVE-2026-48027 (Nx Console supply chain) — developer-facing supply chain compromise appears in the broader ecosystem, less likely for these specific victims but relevant for software-producing organizations

Assessment: HIGH confidence that perimeter-device exploitation (Cisco/Check Point) or MSP RMM compromise (ScreenConnect) is the access path for at least one of these two intrusions, given the victim profile.

Detection Engineering

The following rules target INTERLOCK's known playbook: loader execution from fake-update lures, Cobalt Strike lateral movement, pre-encryption data staging with Rclone/7-Zip, and shadow copy destruction.

---
title: INTERLOCK Ransomware - Fake Update Loader Execution Chain
id: 8f3a1c2e-9b4d-4e7a-a1f5-3c8d2e6b9a01
status: production
description: Detects SocGholish/fake-browser-update style loader execution associated with INTERLOCK initial access. WScript/cscript executing JS from user temp or downloads folders spawned by a browser process.
author: Security Arsenal Threat Intel
references:
    - https://securityarsenal.com/darkside
date: 2026/09/16
modified: 2026/09/16
tags:
    - attack.initial_access
    - attack.t1189
    - attack.t1204
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\chrome.exe'
            - '\msedge.exe'
            - '\firefox.exe'
    selection_child:
        Image|endswith:
            - '\wscript.exe'
            - '\cscript.exe'
            - '\mshta.exe'
            - '\rundll32.exe'
    selection_path:
        CommandLine|contains:
            - '\AppData\Local\Temp\'
            - '\Downloads\'
            - '\AppData\Roaming\'
    selection_ext:
        CommandLine|endswith:
            - '.js'
            - '.jse'
            - '.hta'
            - '.vbs'
    condition: selection_parent and selection_child and selection_path and selection_ext
falsepositives:
    - Rare legitimate browser-triggered installers
level: high
---
title: INTERLOCK Ransomware - Pre-Encryption Data Staging and Exfiltration
id: 2d7b4e9f-1a3c-4f8b-b2e6-5d9a7c1e8f02
status: production
description: Detects data staging behavior observed in INTERLOCK intrusions prior to encryption — Rclone execution, mass 7-Zip archive creation, or FileZilla from non-standard paths.
author: Security Arsenal Threat Intel
date: 2026/09/16
modified: 2026/09/16
tags:
    - attack.collection
    - attack.exfiltration
    - attack.t1560.001
    - attack.t1567.002
    - attack.t1048
logsource:
    category: process_creation
    product: windows
detection:
    selection_rclone:
        - Image|endswith: '\rclone.exe'
        - OriginalFileName: 'rclone.exe'
        - CommandLine|contains:
            - 'rclone copy'
            - 'rclone sync'
            - 'rclone move'
    selection_7z_mass:
        Image|endswith:
            - '\7z.exe'
            - '\7za.exe'
            - '\winrar.exe'
            - '\rar.exe'
        CommandLine|contains:
            - ' a '
            - ' -p'
    selection_7z_target:
        CommandLine|contains:
            - '\\'
            - '.zip'
            - '.7z'
            - '.rar'
    condition: selection_rclone or (selection_7z_mass and selection_7z_target)
falsepositives:
    - Legitimate backup operations using 7-Zip (tune with known backup account/paths)
level: high
---
title: INTERLOCK Ransomware - Shadow Copy Deletion and Backup Sabotage
id: 5c1e8a3d-7f2b-4a9c-c3d7-8e4b6f2a1d03
status: production
description: Detects Volume Shadow Copy deletion and backup catalog tampering executed immediately before INTERLOCK encryption detonation. High-fidelity pre-ransomware indicator.
author: Security Arsenal Threat Intel
date: 2026/09/16
modified: 2026/09/16
tags:
    - attack.impact
    - attack.defense_evasion
    - attack.t1490
logsource:
    category: process_creation
    product: windows
detection:
    selection_vss:
        Image|endswith:
            - '\vssadmin.exe'
            - '\wmic.exe'
            - '\powershell.exe'
            - '\cmd.exe'
        CommandLine|contains:
            - 'delete shadows'
            - 'shadowcopy delete'
            - 'resize shadowstorage'
            - 'Get-WmiObject Win32_Shadowcopy'
            - 'Remove-WmiObject'
    selection_bcd:
        Image|endswith: '\bcdedit.exe'
        CommandLine|contains:
            - 'recoveryenabled no'
            - 'ignoreallfailures'
    selection_wbdb:
        Image|endswith: '\wbadmin.exe'
        CommandLine|contains: 'delete catalog'
    condition: 1 of selection_*
falsepositives:
    - Rare admin maintenance; any hit outside a change window warrants immediate triage
level: critical

// INTERLOCK Hunt: Pre-ransomware staging & lateral movement chain
// Looks for the sequence: suspicious admin tool execution -> remote service creation ->
// mass file archiving -> shadow copy deletion, correlated per host within a 4h window.
// Run over the last 14 days in Microsoft Sentinel.
let lookback = 14d;
let window = 4h;
let SuspiciousTools = datatable(tool:string)[
    "psexec.exe", "psexesvc.exe", "rclone.exe", "7z.exe", "7za.exe",
    "winrar.exe", "rar.exe", "filezilla.exe", "mega.exe", "adfind.exe",
    "netscan.exe", "advanced_port_scanner.exe", "wmic.exe", "nltest.exe", "sharpview.exe"
];
let ToolExec =
    DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where FileName in~ (SuspiciousTools)
    | summarize ToolRuns = count(), Tools = make_set(FileName), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
        by DeviceName, InitiatingProcessAccountName;
let ShadowDelete =
    DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where ProcessCommandLine has_any ("delete shadows", "shadowcopy delete", "resize shadowstorage", "delete catalog", "recoveryenabled no")
    | project DeviceName, ShadowDeleteTime = TimeGenerated, ShadowCmd = ProcessCommandLine;
let RemoteService =
    DeviceEvents
    | where TimeGenerated > ago(lookback)
    | where ActionType == "ServiceInstalled"
    | extend ServiceName = tostring(parse_json(AdditionalFields).ServiceName)
    | where ServiceName has_any ("PSEXESVC", "rclone", "cobalt", "beacon") or AdditionalFields has "ADMIN$"
    | project DeviceName, ServiceTime = TimeGenerated, ServiceName;
ToolExec
| join kind=inner ShadowDelete on DeviceName
| where ShadowDeleteTime between (FirstSeen .. LastSeen + window)
| join kind=leftouter RemoteService on DeviceName
| where isempty(ServiceTime) or ServiceTime between (FirstSeen .. ShadowDeleteTime)
| project DeviceName, InitiatingProcessAccountName, Tools, ToolRuns, FirstSeen, ShadowDeleteTime, ShadowCmd, ServiceName
| sort by ShadowDeleteTime desc;

# INTERLOCK Rapid Triage Script — run on suspected hosts or domain-wide via GPO/Intune
# Checks: new scheduled tasks (7d), shadow copy health, suspicious tools, RDP exposure
$days = 7
$cutoff = (Get-Date).AddDays(-$days)
$report = @()

Write-Host "=== [1] Scheduled tasks created in last $days days ===" -ForegroundColor Cyan
Get-ScheduledTask | ForEach-Object {
    $info = $_ | Get-ScheduledTaskInfo -ErrorAction SilentlyContinue
    $task = $_
    try {
        $xml = Export-ScheduledTask -TaskName $task.TaskName -TaskPath $task.TaskPath -ErrorAction Stop
        if ([xml]$xml -and ($xml -match "Date>`")) { }
    } catch {}
    if ($task.Date -and ([datetime]$task.Date) -gt $cutoff) {
        $report += [pscustomobject]@{Check="NewTask"; Detail="$($task.TaskPath)$($task.TaskName)"; Time=$task.Date}
    }
}

Write-Host "=== [2] Volume Shadow Copy status ===" -ForegroundColor Cyan
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
if (-not $shadows) { $report += [pscustomobject]@{Check="VSS"; Detail="NO shadow copies found — possible deletion"; Time=(Get-Date)} }
else { $shadows | ForEach-Object { $report += [pscustomobject]@{Check="VSS"; Detail="Shadow present: $($_.ID)"; Time=$_.InstallDate} } }

Write-Host "=== [3] Suspicious tooling on disk ===" -ForegroundColor Cyan
$tools = @("rclone.exe","psexec.exe","adfind.exe","netscan.exe","filezilla.exe")
foreach ($t in $tools) {
    $hits = Get-ChildItem -Path "$env:ProgramData","$env:TEMP","C:\Users","C:\Program Files","C:\Program Files (x86)" -Recurse -Filter $t -ErrorAction SilentlyContinue -Force
    foreach ($h in $hits) { $report += [pscustomobject]@{Check="SuspiciousTool"; Detail=$h.FullName; Time=$h.LastWriteTime} }
}

Write-Host "=== [4] RDP exposure ===" -ForegroundColor Cyan
$rdp = Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server" -Name fDenyTSConnections -ErrorAction SilentlyContinue
$rdpEnabled = ($rdp.fDenyTSConnections -eq 0)
$nla = Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" -Name UserAuthentication -ErrorAction SilentlyContinue
if ($rdpEnabled) { $report += [pscustomobject]@{Check="RDP"; Detail="RDP ENABLED; NLA=$($nla.UserAuthentication) (1=on)"; Time=(Get-Date)} }

Write-Host "=== [5] Recent local admins ===" -ForegroundColor Cyan
Get-LocalGroupMember -Group "Administrators" -ErrorAction SilentlyContinue | ForEach-Object {
    $report += [pscustomobject]@{Check="LocalAdmin"; Detail=$_.Name; Time=(Get-Date)}
}

$report | Format-Table -AutoSize
$report | Export-Csv ".\interlock_triage_$(Get-Date -Format yyyyMMdd_HHmm).csv" -NoTypeInformation
Write-Host "Report exported. Investigate any VSS deletion, unknown tasks, or unexpected tooling IMMEDIATELY." -ForegroundColor Yellow

Incident Response Priorities

T-minus detection checklist (before encryption fires)

INTERLOCK's 5–14 day dwell window means you will almost always have observable pre-detonation signals. Hunt for, in order:

1. Discovery commands in bursts — nltest /dclist, net group "Domain Admins" /domain, AdFind or SharpHound output files (*.csv/bloodhound zips in user temp folders)
2. New services on servers — PSEXESVC, oddly named services with random strings, services created via remote ADMIN$ writes
3. Rclone/FileZilla/MEGA processes or configs — .rclone.conf files, large outbound transfers to cloud storage ASNs, sustained 100Mbps+ egress from file servers
4. Mass archive creation — 7-Zip/WinRAR running with password flags (-p) against shares, especially HR, finance, and student/patient records
5. vCenter anomalies — new vCenter sessions from non-admin jump hosts, VM console access outside change windows (relevant given CVE-2026-59310)
6. Backup tampering — Veeam/backup admin logons from unexpected accounts, backup job deletions or retention changes
7. Shadow copy deletion — this is typically the 30-minute warning; treat any vssadmin delete shadows as an active incident

Critical assets INTERLOCK prioritizes for exfiltration

• Student/staff PII databases (SIS exports, HR systems) — for education victims
• Police/utility billing records and resident data — for municipal victims
• Financial records, W-2/payroll data, and legal documents
• Anything with regulatory teeth (FERPA, CJIS, HIPAA-adjacent health records) — they explicitly leverage breach-notification obligations in negotiations

Containment actions, ordered by urgency

1. Isolate, don't nuke: Network-isolate affected hosts/segments immediately but preserve memory — INTERLOCK loaders and Cobalt Strike beacons live in memory and evaporate on reboot
2. Disable compromised identity: Force-reset any account observed in lateral movement; revoke active sessions and tokens (assume domain-wide credential theft via LSASS)
3. Kill egress: Block MEGA, Rclone remotes, and unknown cloud storage at the proxy/firewall NOW to stop in-flight exfiltration
4. Protect backups: Take backup infrastructure offline or into an isolated network segment; verify immutable/offline copies exist before touching production
5. Audit the perimeter: Pull VPN/firewall admin logs for the past 90 days; if Cisco FMC or Check Point is in scope, assume management-plane compromise and rotate all device credentials and certificates
6. Engage counsel early: Public-sector breach notification timelines (state laws, FERPA) start ticking on discovery, not on confirmation

Hardening Recommendations

Immediate (24 hours)

• Patch the KEV perimeter stack: Cisco FMC (CVE-2026-20316), Check Point Security Gateway (CVE-2026-50751), vCenter (CVE-2026-59310), and any residual ConnectWise ScreenConnect instances (CVE-2024-1708). If you cannot patch, take the management interfaces off any reachable network segment
• Block fake-update lures: Deny JS/HTA/VBS execution from browser-spawned processes via AppLocker/WDAC; this kills the SocGholish-style loader chain at step one
• Block Rclone and unsanctioned cloud storage: Egress filtering on MEGA, and application control blocking rclone.exe, filezilla.exe, and unsigned 7z binaries outside backup windows
• Enforce MFA on all remote access — VPN, RDP gateways, and RMM consoles. Audit MSP access paths; require phishing-resistant MFA for any third-party tooling
• Deploy the Sigma rules above and run the KQL hunt across the last 14 days — if you find matches, you are in the dwell window, act accordingly

Short-term (2 weeks)

• Segment the virtualization plane: vCenter and ESXi management interfaces on a dedicated, jump-host-only network. INTERLOCK encrypts at the hypervisor level when possible — vCenter compromise is game over
• Immutable, isolated backups: Move to an architecture where backup repositories cannot be deleted from production credentials (object-lock/immutability, separate identity plane)
• EDR with anti-tamper and VSS protection: Alert on any shadow copy interaction; many EDR platforms can block vssadmin delete outright
• Decommission or broker RDP: No direct internet RDP; route through a gateway with device health checks and session recording
• MSP security review: For public-sector orgs, contractually require MSP MFA, least-privilege RMM access, and 24-hour incident notification. INTERLOCK-type actors increasingly enter through the MSP, not the front door

Intelligence sourced from live monitoring of INTERLOCK's dark web leak site via ransomware.live, cross-referenced with CISA Known Exploited Vulnerabilities. Indicators and TTPs current as of 2026-09-16.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub