Sophos Warns Unprotected Endpoints Let Interlock Credential Theft Go Undetected

Interlock ransomware incident that shows how unprotected endpoints can give attackers enough time to steal credentials, establish persistence, and reach a domain controller before defenders intervene.

During a March 2026 response engagement, Sophos Emergency Incident Response investigators found the group abusing legitimate forensic utilities, including Volatility3 and WinPmem, to acquire memory and extract credential material from a compromised Windows 10 endpoint.

The operation follows a double-extortion model, exfiltrating data before encryption and threatening publication through its “Worldwide Secrets Blog.”

Sophos assesses that Interlock is operated by a relatively small, self-contained team rather than a conventional ransomware-as-a-service affiliate ecosystem.

The incident began after an end user searched ChatGPT for Dynamics 365 and was directed to a legitimate website believed to have been compromised with a ClickFix lure.

ClickFix campaigns manipulate victims into copying and pasting attacker-supplied commands into Windows Run dialogs or terminals.

In this case, the pasted command downloaded PowerShell-based staging code from afshapiro[.]com, retrieved a remote-access payload, and configured it to run at startup.

The initial command also used a wildcard-based PowerShell path, an evasion measure intended to reduce straightforward detection.

Interlock, tracked by Sophos Counter Threat Unit as GOLD EMBRACE, emerged in September 2024 and has targeted organizations across critical infrastructure, healthcare, and education, particularly in North America and Europe.

Sophos found that the compromised Patient Zero device was described as Defender-managed, but it was not effectively protected at the time of the intrusion. This gap proved decisive.

Interlock collected a memory image using the legitimate WinPmem acquisition utility, then ran Volatility3’s windows.hashdump.Hashdump module against mem.raw to recover NTLM hashes, potential LM hashes, and local account information.

Interlock Credential Theft

A subsequent windows.cachedump.Cachedump command attempted to retrieve cached domain credentials and information about users previously logged onto the system.

Such utilities are normally used in digital forensics, incident response, and malware analysis. However, their presence cannot be assumed benign when their execution aligns with unauthorized memory acquisition and credential dumping.

Sophos previously highlighted the broader abuse of trusted response tools, including Velociraptor, by adversaries seeking to blend malicious activity into administrative or security workflows.

The actor paused after establishing foothold and persistence, then resumed activity roughly 24 hours later.

It performed LDAP enumeration, injected a malicious payload through a trusted Microsoft process, queried service principal names for Kerberoasting, and moved to the domain controller over Remote Desktop Protocol.

Sophos observed an anonymous-login NTLM downgrade attack during this lateral movement stage. In just over 26 hours, the intrusion had progressed from an employee endpoint to domain-level compromise.

On the third day, Interlock used the stolen domain administrator access to create a scheduled task masquerading as a Windows Defrag task.

The task executed node.exe and a malicious debug.log payload from the system profile’s roaming directory.

Subsequent activity included AWS credential theft, sensitive-file access, creation of additional domain administrator accounts, Defender tampering, data exfiltration, and lockout of the organization’s hypervisors.

The case also illustrates Interlock ransomware expanding technical range. The group has deployed the NodeSnake, or Interlock RAT, used PHP-based backdoors for persistence, and recently exploited CVE-2026-20131, a critical Cisco Secure Firewall Management Center flaw reported as a zero-day.

Sophos said evidence indicates Interlock exploited the vulnerability about two weeks before Cisco publicly acknowledged it.

Sophos recommends that organizations verify endpoint detection coverage across every workstation and server, audit application-control policies, maintain offline and tested backups, and preserve current asset inventories and network documentation.

The investigated victim believed recoverable backups existed, but ultimately had to rebuild its virtual environment and migrate its heavily compromised Active Directory environment to Entra ID.

Why use the 2026 Agentic SOC Buyer’s Guide? 8 Best Platforms Compared – Download the 2026 Buyer’s Guide