Interlock Ransomware: TTPs And Detection Guide

Interlock ransomware has been active since September 2024, targeting Windows, Linux, and ESXi environments with a hybrid RSA-AES cryptosystem. Unlike many modern ransomware operations, Interlock doesn’t run a ransomware-as-a-service affiliate model. It appears to be operated and shared within a smaller, closely-held group. Combined with double extortion tactics (data theft before encryption) and anti-forensic capabilities like event log clearing and self-deletion, Interlock represents a serious threat to organizations in education, manufacturing, healthcare, and aviation, with the heaviest concentration of victims in the United States, alongside activity in Australia, Canada, and the UK

Threat Overview

Interlock first emerged in 2024 and has continued to evolve, including a Java-based (JAR) variant targeting Windows environments. The group’s core objective is double extortion: exfiltrate sensitive data, encrypt systems, then threaten public leak of stolen data if the ransom isn’t paid within a tight window.

Technical Analysis

Interlock is a command-line-driven binary, which gives operators granular control over each encryption run:

Notable behaviors:

• Persistence & evasion: Uses scheduled tasks and registry modifications to disable the firewall and tamper with certificates

  
  Command-line arguments used by Interlock ransomware for scheduling tasks and executing malware

• Lateral spread via symlinks: Runs fsutil behavior set SymlinkEvaluation commands to enable symbolic link traversal, allowing encryption of files across mapped/linked devices

  
  Commands to enable symbolic link evaluations using fsutil behavior set

• Anti-recovery: Deletes Volume Shadow Copies before encrypting to block easy restoration.
• Encryption scheme: Generates a 48-byte key buffer per file (32-byte AES key + 12-byte IV), then encrypts that buffer with an embedded RSA public key. A standard hybrid cryptosystem approach that makes brute-force decryption infeasible without the attacker’s private key

  
  Hexadecimal representation of ransomware code showing encrypted data

• File exclusions: Deliberately skips system-critical and already-encrypted files (.exe, .dll, .sys, .ps1, Thumbs.db, its own ransom note, etc.) to keep the machine bootable enough to display the ransom demand
• Ransom note: Dropped as IMPORTANT_BEFORE_START.txt in every scanned directory, notable for leaning on regulatory/legal exposure (fines, breach disclosure obligations) rather than pure fear-mongering, with a 72-hour compliance window

  
  Interlock ransom note 

• Anti-forensics: Clears Application, Security, Setup, System, and Forwarded Events logs post-encryption. Self-deletion is achieved by dropping a DLL payload to %TMP%\tmp<random>.wasd and invoking it via rundll32.exe.

  
  Command for self-deletion of ransomware using rundll32.exe and a temporary DLL file 

The threat hunting team wrote a query to detect the behavior of the attack and leveraged an IoC query from the Microsoft Threat Analytics report. The queries are listed below:

 TTPs Query

let InterlockScheduledTask = DeviceProcessEvents
| where Timestamp > ago(30d)
| where (FileName has_any ("schtasks.exe", "schtasks"))
| where ProcessCommandLine has "TaskSystem";

let InterlockSymlinkAbuse = DeviceProcessEvents
| where Timestamp > ago(30d)
| where FileName =~ "fsutil.exe"
| where ProcessCommandLine has "behavior" and ProcessCommandLine has "SymlinkEvaluation";

let InterlockRansomArtifacts = DeviceFileEvents
| where Timestamp > ago(30d)
| where (
    FolderPath has @"!_KEYS_FOR_DECRYPT_"
    or FileName =~ "IMPORTANT_BEFORE_START.txt"
    or FileName endswith ".INT3R1OCK"
);

let InterlockSelfDelete = DeviceProcessEvents
| where Timestamp > ago(30d)
| where FileName =~ "rundll32.exe"
| where ProcessCommandLine matches regex @"tmp[0-9]+\.wasd";

let InterlockEventLogClear = DeviceProcessEvents
| where Timestamp > ago(30d)
| where FileName has_any ("wevtutil.exe", "powershell.exe", "powershell_ise.exe", "cmd.exe")
| where ProcessCommandLine has_any ("wevtutil", "Clear-EventLog", "ClearEventLog")
| where ProcessCommandLine has_any ("Application", "Security", "Setup", "System", "ForwardedEvents")
| where ProcessCommandLine has " cl " or ProcessCommandLine has "Clear-EventLog";

let InterlockVSSDeletion = DeviceProcessEvents
| where Timestamp > ago(30d)
| where (
 (FileName =~ "vssadmin.exe" and ProcessCommandLine has "delete" and ProcessCommandLine has "shadows")
 or (FileName =~ "wmic.exe" and ProcessCommandLine has "shadowcopy" and ProcessCommandLine has "delete")
 or (FileName has_any ("powershell.exe", "powershell_ise.exe")
 and ProcessCommandLine has_any ("Get-WmiObject", "Get-CimInstance")
 and ProcessCommandLine has "shadowcopy"
 and ProcessCommandLine has "Remove")
 or (FileName =~ "diskshadow.exe")
)
| where not(ProcessCommandLine has "Commvault" or FolderPath has "Commvault");

union (InterlockScheduledTask | extend DetectionType = "TaskSystem scheduled task creation")
| union (InterlockSymlinkAbuse | extend DetectionType = "Symlink evaluation enabled via fsutil")
| union (InterlockSelfDelete | extend DetectionType = "Self-deletion via rundll32 + .wasd temp DLL")
| union (InterlockEventLogClear | extend DetectionType = "Event log clearing (wevtutil/PowerShell/cmd)")
| union (InterlockVSSDeletion | extend DetectionType = "Volume Shadow Copy deletion (recovery sabotage)")
| project Timestamp, DeviceName, DetectionType, FileName, FolderPath, ProcessCommandLine, AccountName, InitiatingProcessAccountName, InitiatingProcessCommandLine
| union (
    InterlockRansomArtifacts
    | extend DetectionType = "Interlock ransom artifact / note dropped"
    | project Timestamp, DeviceName, DetectionType, FileName, FolderPath, ProcessCommandLine = "", AccountName = InitiatingProcessAccountName, InitiatingProcessAccountName, InitiatingProcessCommandLine
)
| sort by Timestamp desc

IOCs Query

let fileHashes = dynamic([
    "53efa51fccd9dc1af51945ae02fec47536ca22dd139f92f27840588285156118",
    "11a00160a82b94f20167938654789a2dc8784397eb9124cae8a0df6a90399120"
]);

union
(
    DeviceFileEvents
    | where Timestamp >= ago(30d)
    | where SHA256 in (fileHashes)
    | project Timestamp, FileHash = SHA256, SourceTable = "DeviceFileEvents"
),
(
    DeviceEvents
    | where Timestamp >= ago(30d)
    | where SHA256 in (fileHashes)
    | project Timestamp, FileHash = SHA256, SourceTable = "DeviceEvents"
),
(
    DeviceImageLoadEvents
    | where Timestamp >= ago(30d)
    | where SHA256 in (fileHashes)
    | project Timestamp, FileHash = SHA256, SourceTable = "DeviceImageLoadEvents"
),
(
    DeviceProcessEvents
    | where Timestamp >= ago(30d)
    | where SHA256 in (fileHashes)
    | project Timestamp, FileHash = SHA256, SourceTable = "DeviceProcessEvents"
)
| order by Timestamp desc

Enable attack surface reduction rules, particularly:

• Block executable files unless they meet prevalence/age/trust criteria
• Block process creation from PSExec/WMI (if managed via Intune/MDM)
• Advanced protection against ransomware
• Turn on cloud-delivered protection and tamper protection in Defender Antivirus
• Configure Controlled Folder Access (CFA), especially on sensitive assets. Test in audit mode first
• Run EDR in block mode to catch threats even if a non-Microsoft AV misses them or Defender AV is passive
• Enable automated investigation and remediation and automatic attack disruption in Defender XDR to contain fast-moving encryption events

• Isolate affected devices immediately upon detection of encryption behavior or ransom note drops
• Review Volume Shadow Copy deletion events as a strong precursor signal, act before mass encryption begins
• Rotate credentials for any accounts observed in hands-on-keyboard activity
• Preserve forensic evidence before remediation, since Interlock actively clears event logs

Interlock’s targeting so far skews toward critical-service sectors (healthcare, education, aviation, manufacturing)

Verticals where downtime has outsized real-world consequences, increasing pressure to pay. The group’s non-affiliate model suggests smaller operational footprint but potentially tighter operational security, which can make attribution and pattern-matching harder for defenders

Interlock demonstrates how ransomware operators continue to blend technical sophistication (hybrid cryptosystems, symlink-based lateral encryption) with psychological and legal pressure tactics in ransom notes

For organizations, the risk isn’t just encrypted files. It includes data exfiltration exposure, regulatory notification obligations, operational downtime in sectors where uptime is safety-critical, and reputational fallout from a double-extortion leak. The anti-forensic techniques (log clearing, self-deletion) also mean detection speed matters more than post-incident investigation, since by the time logs are gone, the visibility window has closed

• 24/7 threat monitoring through Microsoft Sentinel, correlating signals across endpoints, identities, and cloud workloads before ransomware reaches the encryption stage
• Managed Detection and Response (MDR) leveraging Defender XDR to catch precursor behaviors such as scheduled task creation, shadow copy deletion, and log-clearing attempts ahead of mass encryption
• Continuous Threat Exposure Management (CTEM) to identify and close the attack surface gaps ransomware groups like Interlock rely on for initial access and lateral movement
• Incident response and containment support to isolate affected systems fast and limit blast radius during an active event
• Proactive threat hunting to search historical telemetry for Interlock-associated TTPs, even in environments where no alert has yet fired