diff --git a/lookups/ransomware_extensions_lookup.csv b/lookups/ransomware_extensions_lookup.csv index 4eb4090601..c93439e246 100644 --- a/lookups/ransomware_extensions_lookup.csv +++ b/lookups/ransomware_extensions_lookup.csv @@ -307,3 +307,5 @@ Extensions,Name *.vanhelsing,Vanhelsing *.vanlocker,Vanhelsing *.termite,Termite +*.interlock,Interlock +*.1nt3rlock,Interlock diff --git a/lookups/ransomware_extensions_lookup.yml b/lookups/ransomware_extensions_lookup.yml index ba5781fdb9..574cb66227 100644 --- a/lookups/ransomware_extensions_lookup.yml +++ b/lookups/ransomware_extensions_lookup.yml @@ -1,5 +1,5 @@ name: ransomware_extensions_lookup -date: 2025-03-18 +date: 2025-07-28 version: 3 id: eaf9e6bb-55fa-4bab-89a5-b0229638c526 author: Splunk Threat Research Team diff --git a/lookups/ransomware_notes_lookup.csv b/lookups/ransomware_notes_lookup.csv index 83a26350d3..1910db7eac 100644 --- a/lookups/ransomware_notes_lookup.csv +++ b/lookups/ransomware_notes_lookup.csv @@ -73,4 +73,5 @@ read_it.txt,True *READ_ME_MEDUSA*.TXT,True How_to_back_files.HTML,True CriticalBreachDetected.pdf,True -How To Restore Your Files.txt, True \ No newline at end of file +How To Restore Your Files.txt, True + !__README__!.txt, True \ No newline at end of file diff --git a/lookups/ransomware_notes_lookup.yml b/lookups/ransomware_notes_lookup.yml index fd3a741f5e..5fdd81e4d6 100644 --- a/lookups/ransomware_notes_lookup.yml +++ b/lookups/ransomware_notes_lookup.yml @@ -1,6 +1,6 @@ name: ransomware_notes_lookup -date: 2025-03-03 -version: 3 +date: 2025-07-28 +version: 4 id: 93d9fb06-035e-496c-91d5-7a79543ce1e1 author: Splunk Threat Research Team lookup_type: csv diff --git a/stories/interlock_ransomware.yml b/stories/interlock_ransomware.yml new file mode 100644 index 0000000000..e445118a20 --- /dev/null +++ b/stories/interlock_ransomware.yml @@ -0,0 +1,18 @@ +name: Interlock Ransomware +id: 4aad8560-07cb-4114-97fc-66963da3a354 +version: 1 +date: '2025-07-28' +author: Teoderick Contreras, Splunk +status: production +description: Leverage searches that allow you to detect and investigate unusual activities associated with Interlock Ransomware, such as unexpected file encryption patterns, anomalous process execution (e.g., PowerShell or CMD spawning from Office applications), and large-scale file renaming. Look for indicators including creation of ransom notes (e.g., !__README__!.txt), high volumes of file modifications in short time spans, and suspicious outbound connections to command-and-control infrastructure. Correlate these behaviors with privilege escalation attempts, scheduled tasks or registry changes, and endpoint detections tied to known Interlock payloads. Implement behavioral analytics and MITRE ATT&CK mappings (e.g., T1486 - Data Encrypted for Impact) to surface early signs of ransomware activity before full encryption occurs. +narrative: The Interlock ransomware variant was first observed in late September 2024, targeting various business, critical infrastructure, and other organizations in North America and Europe. FBI maintains these actors target their victims based on opportunity, and their activity is financially motivated. FBI is aware of Interlock ransomware encryptors designed for both Windows and Linux operating systems; these encryptors have been observed encrypting virtual machines (VMs) across both operating systems. FBI observed actors obtaining initial access via drive-by download from compromised legitimate websites, which is an uncommon method among ransomware groups. Actors were also observed using the ClickFix social engineering technique for initial access, in which victims are tricked into executing a malicious payload under the guise of fixing an issue on the victim’s system. Actors then use various methods for discovery, credential access, and lateral movement to spread to other systems on the network. +references: +- https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-203a +tags: + category: + - Malware + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection