Interlock ransomware and FileFix

Summary

Interlock has been run against businesses and critical infrastructure in North America and Europe since September 2024. Two ways in are on record: a drive-by download from broken-into websites, or a counterfeit CAPTCHA page whose numbered steps talked the visitor into pasting the clipboard into the Run box — later into a file-manager address bar, the variant called FileFix. Both routes started a PowerShell stage that pulled down a remote access trojan dressed as a browser update or a VPN client installer. The DFIR Report documented a PHP rewrite of that trojan in June 2025, reached through the KongTuke web-inject and calling home over tunnel hostnames. A joint FBI, CISA, HHS and MS-ISAC advisory followed eight days later. Operators then took credentials, moved between hosts over RDP, pushed data to cloud storage, and encrypted virtual machines.

Cross-vendor timeline

2 published accounts. The DFIR Report was first, on 2025-07-14. The most recent is CISA, 8 days later.

1. 2025-07-14The DFIR Report

   KongTuke FileFix Leads to New Interlock RAT Variant

2. 2025-07-22CISA+8 days

   #StopRansomware: Interlock

Dates are the publishers’ own publication dates as recorded when we retrieved each article. Publication order is not attribution: a later account may be the more complete one.

Execution mechanisms

How the pasted command actually ran, as the published accounts describe it. Every row under “Mechanism” is one this campaign records; “Across the corpus” is the share of the 44 published campaigns in this corpus that record the same one — a baseline we can only state because we hold the whole set.

No other campaign on record combines them. We record a mechanism only where a source describes one: an absent mechanism means nobody wrote it down, not that it did not happen.

Indicators

50 indicators, each present verbatim in at least one of the sources above. Values are shown defanged and are not links to the hosts — the link goes to our page for that indicator.

“Assessment” is who controls the host, not how dangerous it is. Many of these are compromised legitimate sites whose owners are victims, and they are excluded from every blocklist file we publish.