interlock_ransomware

lookups/ransomware_extensions_lookup.csv

@@ -307,3 +307,5 @@ Extensions,Name
 *.vanhelsing,Vanhelsing
 *.vanlocker,Vanhelsing
 *.termite,Termite
+*.interlock,Interlock
+*.1nt3rlock,Interlock

lookups/ransomware_extensions_lookup.yml

@@ -1,5 +1,5 @@
 name: ransomware_extensions_lookup
-date: 2025-03-18
+date: 2025-07-28
 version: 3
 id: eaf9e6bb-55fa-4bab-89a5-b0229638c526
 author: Splunk Threat Research Team

lookups/ransomware_notes_lookup.csv

@@ -73,4 +73,5 @@ read_it.txt,True
 *READ_ME_MEDUSA*.TXT,True
 How_to_back_files.HTML,True
 CriticalBreachDetected.pdf,True
-How To Restore Your Files.txt, True
+How To Restore Your Files.txt, True
+ !__README__!.txt, True

lookups/ransomware_notes_lookup.yml

@@ -1,6 +1,6 @@
 name: ransomware_notes_lookup
-date: 2025-03-03
-version: 3
+date: 2025-07-28
+version: 4
 id: 93d9fb06-035e-496c-91d5-7a79543ce1e1
 author: Splunk Threat Research Team
 lookup_type: csv

stories/interlock_ransomware.yml

@@ -0,0 +1,18 @@
+name: Interlock Ransomware
+id: 4aad8560-07cb-4114-97fc-66963da3a354
+version: 1
+date: '2025-07-28'
+author: Teoderick Contreras, Splunk
+status: production
+description: Leverage searches that allow you to detect and investigate unusual activities associated with Interlock Ransomware, such as unexpected file encryption patterns, anomalous process execution (e.g., PowerShell or CMD spawning from Office applications), and large-scale file renaming. Look for indicators including creation of ransom notes (e.g.,  !__README__!.txt), high volumes of file modifications in short time spans, and suspicious outbound connections to command-and-control infrastructure. Correlate these behaviors with privilege escalation attempts, scheduled tasks or registry changes, and endpoint detections tied to known Interlock payloads. Implement behavioral analytics and MITRE ATT&CK mappings (e.g., T1486 - Data Encrypted for Impact) to surface early signs of ransomware activity before full encryption occurs.
+narrative: The Interlock ransomware variant was first observed in late September 2024, targeting various business, critical infrastructure, and other organizations in North America and Europe. FBI maintains these actors target their victims based on opportunity, and their activity is financially motivated. FBI is aware of Interlock ransomware encryptors designed for both Windows and Linux operating systems; these encryptors have been observed encrypting virtual machines (VMs) across both operating systems. FBI observed actors obtaining initial access via drive-by download from compromised legitimate websites, which is an uncommon method among ransomware groups. Actors were also observed using the ClickFix social engineering technique for initial access, in which victims are tricked into executing a malicious payload under the guise of fixing an issue on the victim’s system. Actors then use various methods for discovery, credential access, and lateral movement to spread to other systems on the network.
+references:
+- https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-203a
+tags:
+  category:
+  - Malware
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection