Interlock Ransomware Uses Multi-Stage Attack Through Legitimate Websites to Deliver Malicious Browser Updates

The Interlock ransomware intrusion set has escalated its operations across North America and Europe with sophisticated techniques.

Not falling under the typical Ransomware-as-a-Service (RaaS) category, Interlock operates independently, focusing primarily on Big Game Hunting and double extortion campaigns.

This group’s activities have been closely monitored by cybersecurity firms such as Sekoia Threat Detection & Research (TDR) and others, revealing their evolving tactics and tools.

- Advertisement -

Attack Mechanism and Execution

Interlock initiates its attack by compromising legitimate websites to host deceptive browser update pages, leveraging the trust users have in these platforms.

Here’s how the attack unfolds:

1. Fake Updater Deployment:

The ransomware’s initial access vector is a fake browser update hosted on compromised websites.

These updates appear as legitimate Google Chrome or Microsoft Edge installers but are, in fact, PyInstaller files. When a user executes this update, it:

• Downloads and runs a legitimate installer.
• Simultaneously, it launches a PowerShelcl script acting as a backdoor.

2.PowerShell Backdoor:

This script operates in a loop, continuously executing HTTP requests to communicate with command-and-control (C2) servers. It’s designed for resilience, utilizing:

• A continuous communication loop with the C2 server for persistence.
• Collection of system information including user context, system details, and more, then transmitting this data to the attacker.

3.Command Execution:

The C2 server can issue various commands, including:

• Terminating the backdoor.
• Deploying additional malware like keyloggers or credential stealers (e.g., LummaStealer, BerserkStealer).

Domain and IP Clustering for Resilience

According to the Report, Interlock’s operators employ a strategy of IP address clustering to maintain their infrastructure’s resilience:

Cluster Composition

Each cluster typically includes:

• One IP from BitLaunch, allowing cryptocurrency transactions.
• One from Hetzner Online GmbH, known for its robust hosting services.
• A third from various autonomous systems to complicate disruption efforts.

ClickFix Technique for Initial Access

Around January 2025, Interlock adopted the ClickFix technique:

• Deceptive Prompts: Victims are persuaded to manually execute malicious PowerShell commands through fake CAPTCHA verifications or system prompts.

• Fake Installer Distribution: This technique was used to distribute a fake installer payload, but its usage seemed to have been abandoned by February 2025.

The sophistication and evolution of Interlock’s tactics, from using fake browser updates to employing social engineering techniques like ClickFix, illustrate its adaptability and potential for further growth.

With a focus on high-value targets and the ability to evade traditional network security, Interlock remains a significant threat.

Cybersecurity measures must be updated continuously to counter the dynamic strategies of this ransomware group.

Indicators of Compromise (IoC)

The following table lists the IoCs associated with Interlock’s activities:

Find this News Interesting! Follow us on Google News, LinkedIn, & X to Get Instant Updates!