Interlock ransomware is leveraging familiar Windows tools to facilitate credential theft, marking a significant evolution in cyber threats. By repurposing memory analysis software, the attackers are extracting password hashes and account data from compromised systems, posing a severe risk to organizational security.
Exploitation of Security Tools
Attackers have transformed legitimate software into tools for breaching secure environments. Through a compromised workstation, Interlock gained initial access, proceeding to escalate privileges and reach a domain controller. The breach resulted in data theft and the victim being locked out of hypervisors. Sophos analysts uncovered this activity during a March 2026 investigation, tracing it to the group known as GOLD EMBRACE, active since September 2024.
This group targets critical sectors like infrastructure, healthcare, and education across North America and Europe. Their strategy involves combining data theft with encryption and threatening to release the stolen information unless demands are met, as highlighted in a Sophos report shared with Cyber Security News (CSN).
Technical Details and Attack Methodology
The attack commenced on an unprotected Windows 10 device, where Interlock utilized Volatility3 to extract NTLM and legacy LM password hashes. By running this tool against cached domain credentials, they could access username and hash pairs of previous users. The use of WinPmem to collect memory images further facilitated their intrusion.
The misuse of these tools is concerning because security teams typically expect them during forensic investigations, not ransomware attacks. Trusted programs can mask malicious activities, complicating the detection and response efforts. ClickFix tactics have been employed in other recent attacks targeting Windows users, demonstrating the ongoing threat.
Implications and Defensive Measures
The attack unfolded rapidly, with initial access gained through a compromised website. Within 26 hours, the attackers moved from the first device to the domain controller, employing a wildcard path to launch PowerShell and evade detection. Their activities included directory queries and Kerberoasting, highlighting the dangers of password theft in compromising Windows domains.
By day three, Interlock had established new domain-admin accounts and tampered with security software, culminating in significant data theft. The group also explored a critical Cisco firewall zero-day, emphasizing the need for organizations to patch systems promptly and monitor for unusual activities.
Organizations are advised against blanket bans on administration tools. Instead, they should ensure endpoint protection is active on all systems, define when memory tools are permissible, and alert on unexpected data collection or hash-dumping activities. Regular testing of backups, maintaining an up-to-date asset inventory, and reviewing application-control policies are crucial preventive measures.
Interlock’s arsenal, including NodeSnake and InterlockRAT, underscores the necessity for continuous monitoring of behavior during intrusions. Relying solely on malware names or file signatures is insufficient for a comprehensive defense strategy.
