interlockMalware
Last reported yesterday, by RansomLook17 reports
ATT&CK techniques
6 of 7 · each with the sentence it comes from- T1036Masquerading
“This specific ClickFix page was observed on four different URLs, but only the one masquerading Advanced IPScanner seems to deliver a fake installer, the others executing the PowerShell backdoor via an obfuscated loader.”
- T1053.005Scheduled Task
“The Windows variant of the ransomware creates a scheduled task to be executed every day at 8:00 PM.”
- T1055.005Thread Local Storage
“The executable is protected by a custom packer and unpacked using a code stored in its Thread Local Storage.”
- T1056.001Keylogging
“The executables packed in this custom packer were indeed files related to keylogging activity and information stealer.”
- T1480Execution Guardrails
“In February 2025, this loader was improved with some interesting execution guardrails:”
- T1558.003Kerberoasting
“Additionally, they observed commands used for pre-kerberoasting reconnaissance.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
17 reports, newest first · the exact sentence from each-
interlock lists Madison Honda“interlock lists Madison Honda”
-
interlock lists Custom Floors Unlimited“interlock lists Custom Floors Unlimited”
-
interlock lists Coastal Alabama Community College“interlock lists Coastal Alabama Community College”
-
interlock lists Pedigo Products, Inc.“interlock lists Pedigo Products, Inc.”
-
interlock lists Valenti Management“interlock lists Valenti Management”
-
interlock lists Concord Eye Center“interlock lists Concord Eye Center”
-
interlock lists Greentech Environmental“interlock lists Greentech Environmental”
-
interlock lists Engineers Contractors Fabricators Inc. (ECF)“interlock lists Engineers Contractors Fabricators Inc.”
-
interlock lists Nu-Quest Distribution Inc“interlock lists Nu-Quest Distribution Inc”
-
interlock lists Shalom Christian Academy“interlock lists Shalom Christian Academy”
-
interlock lists Riviera Healthcare Center“interlock lists Riviera Healthcare Center”
-
interlock lists H&L Manufacturing“interlock lists H&L Manufacturing”
-
interlock lists O2 Dental Group“interlock lists O2 Dental Group”
-
interlock lists Blaise C. Bender, PC“interlock lists Blaise C.”
-
interlock lists Tekko Enterprises, Inc“interlock lists Tekko Enterprises, Inc”
-
interlock lists The Center for Kidney Care“interlock lists The Center for Kidney Care”
-
Interlock Ransomware: Evolving Under the Radar with ClickFix“The names of encrypted files are modified with the extension .interlock used in the earlier version, and .!NT3R10CK in the more recent samples observed.”
Indicators in its reports
named in the reports above- sublime-forecasts-pale-scored.trycloudflare[.]comin 1 report
- washing-cartridges-watts-flags.trycloudflare[.]comin 1 report
- investigators-boxing-trademark-threatened.trycloudflare[.]comin 1 report
- fotos-phillips-princess-baker.trycloudflare[.]comin 1 report
- casting-advisors-older-invitations.trycloudflare[.]comin 1 report
- complement-parliamentary-chairs-hc.trycloudflare[.]comin 1 report
- hxxps://microsoft-msteams[.]com/additional-check.htmlin 1 report
- microsoft-msteams[.]comin 1 report
- hxxps://microstteams[.]com/additional-check.htmlin 1 report
- microstteams[.]comin 1 report
- hxxps://ecologilives[.]com/additional-check.htmlin 1 report
- ecologilives[.]comin 1 report
- hxxps://advanceipscaner[.]com/additional-check.htmlin 1 report
- advanceipscaner[.]comin 1 report
- hxxp://topsportracing[.]com/wp-25in 1 report
- topsportracing[.]comin 1 report
- www.advanced-ip-scanner[.]comin 1 report
- hxxps://nodejs[.]org/dist/v22.11.0/node-v22.11.0-win-x64.zipin 1 report
- 96.62.214[.]11in 1 report
- 576d07cc8919c689…5d373905a296in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.