Interlock Ransomware

Who Interlock is

Interlock is a ransomware group first observed in September 2024 that targets critical infrastructure sectors including healthcare, government, education, and technology across North America and Europe using double-extortion, with 57+ claimed victims including a major US dialysis provider exposing over two million patient records.

Recorded activity

Disclosures attributed to Interlock in this database run from October 2024 to August 2026, totalling 125 victims — 0.6% of everything tracked here. Interlock has listed victims in 8 countries in this database, most often United States, followed by Canada and United Kingdom. The sectors appearing most in its listings are Education, Manufacturing, Public Sector.

Tooling observed in Interlock operations

• ProcessHacker
• Advanced Port Scanner
• Azure Storage Explorer
• AZCopy
• WinSCP
• PsExec
• PuTTY
• Cobalt Strike
• AnyDesk
• ScreenConnect

Software reported in use by Interlock. Most are legitimate administration or transfer utilities; their presence in an environment is a signal to investigate, not proof of compromise.

Indicators of compromise

• e11d147dad6e47a1cecb1f2755f95a55
• f7f679420671b7e18677831d4d276277
• f76d907ca3817a8b2967790315265469
• 6c3b2558fc8cfcb2751437b6e5cdeb6f
• 6d034dca42ffea354a20cd15d3f2ffd5
• faf9a658f4f9b424be3dab262a8af81c
• a26f0a2da63a838161a7d335aaa5e4b314a232acc15dcabdb6f6dbec63cda642
• c9920e995fbc98cd3883ef4c4520300d5e82bab5d2a5c781e9e9fe694a43e82f
• e86bb8361c436be94b0901e5b39db9b6666134f23cce1e5581421c2981405cb1
• 23.95.182.59
• 195.201.21.34
• 159.223.46.184

Showing a sample of 9 MD5, 3 SHA256, 3 IP on file. Hashes and network indicators published for Interlock. Leak-site addresses are deliberately excluded. Indicators age quickly — treat a match as a starting point for investigation, and an absence of matches as no assurance.

YARA detection rules

/*
Interlock ransomware
*/

rule Interlock_Ransomnote
{
    meta:
        author = "ransomware.live"
        family = "ransomware.interlock"
        description = "Detects Interlock ransomware ransom note"
        date = "2026-05-04"
        severity = 7
        score = 70

    strings:
        $s1 = "!README!.txt" ascii nocase
        $s2 = "INTERLOCK" ascii nocase
        $s3 = ".interlock" ascii
        $s4 = "Interlock" ascii

    condition:
        2 of them
}

Community-contributed rules for Interlock, reproduced as published. Test them against your own corpus before relying on them: rule quality and false-positive behaviour vary by author.