Talos Details Interlock Ransomware’s Attack Chain and Links to Rhysida
Summary
Talos describes Interlock ransomware attacks involving a fake Chrome updater, credential theft, lateral movement and data exfiltration. The group encrypts Windows and Linux systems; Talos sees low-confidence overlaps with Rhysida.
Key points
- Talos observed a fake Chrome updater delivered from compromised websites that installed a RAT and launched PowerShell scripts.
- The attacker deployed a credential stealer and keylogger, used RDP and remote-access tools for lateral movement, and may have used Kerberoasting to obtain higher-privilege accounts.
- Azure Storage Explorer and AzCopy were used to exfiltrate victim data to an attacker-controlled Azure storage blob.
- Talos observed about 17 days between initial compromise and ransomware deployment, along with attempts to disable EDR and delete event logs.
- Interlock encrypts files on Windows and Linux, uses double extortion, and threatens to publish stolen data if victims do not respond within 96 hours.
- Talos found technical and operational similarities with Rhysida but assesses a possible connection with low confidence.
Article Details
- Attack Vectors
- A fake Google Chrome updater was downloaded after a victim was prompted by a compromised legitimate news website; the executable was then downloaded from a second compromised legitimate retailer URL.
- The fake updater acted as a RAT and ran embedded PowerShell scripts to download and execute a credential stealer and keylogger.
- The attacker used RDP and compromised credentials for lateral movement; AnyDesk and possibly LogMeIn were also used for remote connectivity, while PuTTY was likely used to move laterally to Linux hosts.
- PowerShell reconnaissance commands searched for computers and users with service principal names; Talos assessed with moderate confidence that Kerberoasting was used to obtain higher-privilege accounts.
- The attacker used Azure Storage Explorer and AzCopy to identify and upload victim data to an attacker-controlled Azure storage blob.
- The Interlock encryptor was deployed on Windows and Linux systems, encrypted files, and threatened data disclosure through double extortion.
- Defensive Notes
- Talos observed EDR disabled on some compromised servers and attempted deletion of event logs; investigate and preserve relevant endpoint and log evidence.
- Review and restrict unauthorized remote access through RDP, AnyDesk, LogMeIn, and PuTTY, and monitor for suspicious PowerShell and rundll32.exe activity.
- Monitor for unauthorized use of Azure Storage Explorer or AzCopy and unexpected uploads to Azure storage.
- Use multi-factor authentication, as recommended in the article's Cisco Duo coverage guidance.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | apple-online[.]shop | Attacker-controlled Cloudflare domain used to conceal the RAT's C2 server. |
interlock@2mail[.]co | Email address published by Interlock for victim communications. |
MITRE ATT&CK
T1021.001 · Remote Desktop ProtocolThe attacker primarily used RDP to move laterally between victim systems.T1053.005 · Scheduled TaskThe Windows ransomware created a daily scheduled task named TaskSystem to run the encryptor.T1056.001 · KeyloggingThe keylogger hooked the victim's keyboard and logged keystrokes to a file.T1059.001 · PowerShellThe fake updater ran embedded PowerShell scripts to download and execute additional payloads.T1070.004 · File DeletionThe ransomware deleted its encryptor binary after encryption.T1071 · Application Layer ProtocolThe RAT sent encrypted victim-system information over a secured socket to its C2 server.T1189 · Drive-by CompromiseThe victim was prompted to download a fake browser updater from a compromised legitimate news website.T1486 · Data Encrypted for ImpactInterlock encrypted targeted files on victim Windows and Linux systems.T1547.001 · Registry Run Keys / Startup FolderThe RAT established persistence with a Windows shortcut in the Startup folder.T1555.003 · Credentials from Web BrowsersThe credential stealer collected browser login data and related profile files.T1558.003 · KerberoastingTalos assessed with moderate confidence that Kerberoasting was used to obtain accounts with higher privileges.T1567.002 · Exfiltration to Cloud StorageThe attacker used AzCopy to upload victim data to an attacker-controlled Azure storage blob.
People
Threat Actors
ALPHVRansomware group mentioned for comparison of ransom-note behavior.Black BastaRansomware group mentioned for comparison of ransom-note behavior.InterlockRansomware group observed conducting big-game hunting and double-extortion attacks.RhysidaRansomware group whose operators or developers Talos assesses, with low confidence, may be connected to Interlock's emergence.
Malware
Vendors
Products
Adaptive Security ApplianceNext-Generation Firewall and Firepower NGFW) appliances such as Threat Defense Virtual, Adaptive Security Appliance and Meraki MX can detect malicious activity associated with this threat. AzureThe attacker used Azure Storage Explorer, which leverages the utility AZCopy, to exfiltrate the victim’s data to an attacker-controlled Azure storage blob. Cisco DuoCisco Duo provides multi-factor authentication for users to ensure only those authorized are accessing your network. Cisco Secure EmailCisco Secure Email (formerly Cisco Email Security) can block malicious emails sent by threat actors as part of their campaign. You can try Secure Email for free here. Cisco Secure EndpointCisco Secure Endpoint (formerly AMP for Endpoints) is ideally suited to prevent the execution of the malware detailed in this post. Try Secure Endpoint for free here. Cisco Secure FirewallCisco Secure Firewall (formerly Next-Generation Firewall and Firepower NGFW) appliances such as Threat Defense Virtual, Adaptive Security Appliance and Meraki MX can detect malicious activity associated with thisCisco Secure Malware AnalyticsCisco Secure Malware Analytics (Threat Grid) identifies malicious binaries and builds protection into all Cisco Secure products. Cisco Secure Web ApplianceCisco Secure Web Appliance web scanning prevents access to malicious websites and detects malware used in these attacks. ClamAVClamAV detections are also available for this threat: Cloudflarea secured socket to the command and control (C2) server hidden behind the attacker-controlled Cloudflare domain “apple-online[.]shop”, sends the encrypted data stream of victim machine information to the C2Google ChromeThe attacker gained access to the victim machine via a fake Google Chrome browser updater executable that the victim was prompted to download from a compromised legitimate news website. When clicked, the fake browserMeraki MXFirewall and Firepower NGFW) appliances such as Threat Defense Virtual, Adaptive Security Appliance and Meraki MX can detect malicious activity associated with this threat. Microsoft Windowsto the victim machine’s applications temporary folder and established persistence by dropping a Windows shortcut file in the Windows StartUp folder with the file name “fahhs.lnk” configured to run the RATSnortOpen-source Snort Subscriber Rule Set customers can stay up to date by downloading the latest rule pack available for purchase on Snort.org. Snort SIDs for this threat are 64114, 64113, 64189 and 301042. Threat Defense VirtualCisco Secure Firewall (formerly Next-Generation Firewall and Firepower NGFW) appliances such as Threat Defense Virtual, Adaptive Security Appliance and Meraki MX can detect malicious activity associated with thisUmbrellaUmbrella, Cisco's secure internet gateway (SIG), blocks users from connecting to malicious domains, IPs and URLs, whether users are on or off the corporate network. Sign up for a free trial of Umbrella here.
Tools
AnyDeskWe also observed that the attacker primarily used remote desktop protocol (RDP) to move laterally within the victim’s network, as well as other tools such as AnyDesk and PuTTY. AzCopyThe attacker used Azure Storage Explorer, which leverages the utility AZCopy, to exfiltrate the victim’s data to an attacker-controlled Azure storage blob. Azure Storage ExplorerThe attacker used Azure Storage Explorer, which leverages the utility AZCopy, to exfiltrate the victim’s data to an attacker-controlled Azure storage blob. LogMeInto move between systems. Further analysis showed that the attacker has also used AnyDesk and possibly LogMeIn to allow remote connectivity. We also spotted the installation of PuTTY on the compromised machines,PowerShellin the delivery chain including a Remote Access Tool (RAT) masquerading as a fake browser updater, PowerShell scripts, a credential stealer, and a keylogger before deploying and enabling the ransomware encryptorPuTTYWe also observed that the attacker primarily used remote desktop protocol (RDP) to move laterally within the victim’s network, as well as other tools such as AnyDesk and PuTTY. rundll32.exeand runs them. We observed that the keylogger is a DLL file that is run using the LOLBin “rundll32.exe”.
Countries
Industries
Governmentbusinesses in a wide range of sectors, which at the time of reporting includes healthcare, technology, government in the U.S. and manufacturing in Europe, according to the data leak site disclosure, indicating theirHealthcarehas notably targeted businesses in a wide range of sectors, which at the time of reporting includes healthcare, technology, government in the U.S. and manufacturing in Europe, according to the data leak siteManufacturingsectors, which at the time of reporting includes healthcare, technology, government in the U.S. and manufacturing in Europe, according to the data leak site disclosure, indicating their targeting is opportunistic. Technologytargeted businesses in a wide range of sectors, which at the time of reporting includes healthcare, technology, government in the U.S. and manufacturing in Europe, according to the data leak site disclosure,