Interlock ransomware, active since September 2024, conducts continuous attacks across North America and Europe by encrypting files with AES-256-GCM and stealing sensitive data for extortion via a Tor-based negotiation site. The malware uses OpenSSL for combined AES/RSA encryption (RSA-4096 for key wrapping), hides core code via runtime code patching, and appends encrypted key material to files to prevent local recovery. #Interlock #AES-256-GCM
Keypoints
- Interlock first appeared in late September 2024 and targets businesses and critical infrastructure in North America and Europe, stealing data and threatening public disclosure if ransoms are unpaid.
- The ransomware encrypts files using AES-256-GCM and wraps the symmetric key and IV with an RSA-4096 public key, embedding the encrypted key material at the end of each file.
- Encryption is implemented via the OpenSSL library, enabling high-performance AES/RSA operations and leaving no local artifacts that enable decryption without the attacker’s private key.
- The malware hides its main code by encrypting/obfuscating it and performing code patching at runtime so the original code appears only in memory during execution, hindering detection and analysis.
- Interlock supports command-line arguments to control behavior (e.g., target folder, single-file encryption, force encrypt, create scheduled task for privilege escalation, self-delete) and can enable symbolic link access to reach linked files.
- It excludes specific system folders, common executable extensions, and marker files (e.g., !NT3RLOCK, OPEN_BEFORE_ANYTHING.txt) from encryption and appends the ransom note referencing a Tor negotiation site and regulatory threats (GDPR, HIPAA, etc.).
- AhnLab detection records and several MD5 hashes are listed, indicating sample identification and known signatures used by security products.
MITRE Techniques
- [T1490] Data Encrypted for Impact – Interlock encrypts files using AES-256-GCM and embeds RSA-4096-wrapped keys at the end of files to prevent local recovery (“the symmetric key and initial value IV are encrypted using RSA-4096 public key and inserted at the end of the file”).
- [T1027] Obfuscated Files or Information – The ransomware obfuscates main code and performs code patching at execution so original code appears only in memory to evade analysis (“initially encrypts or obfuscates the main code and hides it, only to perform code patching at the execution time to release it in memory”).
- [T1070.004] File Deletion – The malware can self-delete when invoked with the ‘-del’ argument (“-del Self-delete”).
- [T1059] Command and Scripting Interpreter – Interlock accepts command-line arguments to control behaviors such as encrypting a folder or single file and forcing encryption (“-d Attempt to encrypt specified folder”, “-f Encrypt one file only”, “-r Attempt to encrypt forcibly”).
- [T1547.001] Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder – The ransomware can create and run a scheduled task for privilege escalation using the ‘-s’ argument (“-s Create and run task scheduler (privilege escalation)”).
- [T1218] Signed Binary Proxy Execution – The malware terminates processes being encrypted to allow file modification, indicating use of process manipulation to achieve file access (“the agent performs the action to terminate the processes that are being encrypted, if the ‘-r’ argument exists”).
- [T1486] Data Encrypted for Impact (Ransom Note) – The group drops a ransom note that includes a Tor negotiation URL and threatens regulatory exposure to coerce victims (“The ransom note includes the negotiation site URL based on the Tor network … warns of the potential violation of major legal regulations such as GDPR, GLBA, HIPAA…”).
Indicators of Compromise
- [File extension] Encrypted file extension – .!NT3RLOCK (Interlock’s predefined encrypted file extension).
- [File names] Exclusion/marker files – OPEN_BEFORE_ANYTHING.txt, Thumbs.db (used as exclusions and markers).
- [Hashes] Sample MD5 hashes – 3104efb23ea174ac5eda9f5fd0e8c077, 33d8eabbf428fef8c5cd50b440ee3d07 (and 3 more MD5 hashes listed).
- [Detection names] AV/EDR signatures – Ransomware/Win.INTERLOCK.C5753860, Ransom/MDP.Event.M1946 (AhnLab diagnostic names indicating detections).
Read more: https://asec.ahnlab.com/en/89912/