Interlock 2026 Tracker: Every Victim, Every Method

A drive-by-and-ClickFix ransomware crew that emerged in late 2024. CISA and the FBI published a joint advisory in July 2025. The leak site now lists 140 named victims across healthcare, education, manufacturing, and city governments through October 2026.

State of Surveillance

TL;DR: Interlock is a financially motivated ransomware crew first observed in late September 2024 that runs a double-extortion playbook (encrypt systems, then threaten to leak stolen data).[1] On July 22, 2025 the FBI, CISA, HHS, and MS-ISAC published joint advisory AA25-203A, warning that the group has been targeting organizations in North America and Europe since at least September 2024 and that its encryptors run on Windows, Linux, and FreeBSD.[1] The group's own data-leak site, monitored by ransomware.live, lists 140 named victims as of October 21, 2026.[2] The largest publicly confirmed breach is DaVita (kidney dialysis): data on 2.7 million people was exposed after Interlock claimed the April 2025 attack.[5] Other named victims include Kettering Health (Ohio), Wayne County (Michigan), the District of Columbia Housing Authority, Reynella East College (Australia), the University of Warsaw (Poland), the Waterford Hotel Group (Ireland), and Brockton Neighborhood Health Center (Massachusetts).[2] IBM X-Force tracks the operation as Hive0163 and ties its custom malware family (NodeSnake, InterlockRAT, Supper, JunkFiction downloader) to Rhysida operators through shared code, with Rhysida tracked by Microsoft as Vanilla Tempest.[3]

What Interlock Actually Is

Interlock is a ransomware crew, not a piece of malware. The name comes from the file extension the encryptor leaves on victim files: .interlock, or the variant .1nt3rlock.[1] CISA's AA25-203A advisory identifies the actors as financially motivated and opportunistic, running a double-extortion model that combines file encryption with a data-leak threat.[1] Different vendors track the same operation under overlapping labels. IBM X-Force calls it Hive0163 and reports that Cisco Talos assessed, with low confidence, that Interlock is likely a new diversified group that emerged from Rhysida ransomware operators or developers.[3] Cisco Talos contributed to the CISA advisory.[1]

What separates Interlock from the pack is the way it gets in. The CISA advisory is unusually specific about the initial-compromise vectors, and they are not the standard phishing-and-stolen-credentials playbook most ransomware crews use.[1] The group uses two distinct lures that both end up running PowerShell on the victim's machine: a drive-by download disguised as a fake browser or security-software update, and a fake CAPTCHA or "human verification" page that walks the victim through pasting a malicious command into the Windows Run dialog (the technique the industry calls ClickFix).[1] IBM X-Force and BlackFog both note a 2025 evolution to FileFix, which abuses the Windows File Explorer address bar instead of the Run dialog.[4][3]

The malware itself is cross-platform from the start. CISA's AA25-203A confirms encryptors "designed for both Windows and Linux operating systems" plus a FreeBSD ELF encryptor, and notes the encryptors "have been observed encrypting virtual machines (VMs) across both operating systems."[1] The Windows encryptor binary is named conhost.exe and uses AES plus RSA, leaving a ransom note titled !__README__!.txt delivered via group policy object.[1] Ransom notes do not include an initial dollar figure; victims get a unique code and a .onion Tor URL and are asked to negotiate via Bitcoin.[1]

Known Victims

This list covers publicly reported victims confirmed by CISA, the victims themselves, primary news reporting, or the victims' appearance on Interlock's own leak site as captured by the third-party ransomware.live tracker.[2] Where the only source is the leak site itself, the entry is dated to the day the victim's name was posted, not the day the intrusion happened. It is a selection, not a complete list.

DaVita (April 2025): 2.7 million people

DaVita, the U.S. kidney dialysis provider, was hit in April 2025. Ransomware group Interlock claimed responsibility for the attack, and data on 2.7 million people was exposed.[5] DaVita appears on the leak site dated 2025-04-25.[2] BlackFog puts the exfiltration at "more than two million patient records" before encryption.[4]

Kettering Health: 14 facilities offline

Kettering Health, an Ohio-based hospital system, appears on the leak site dated 2025-06-04.[2] BlackFog reports that "an Ohio hospital system with 14 facilities went dark when Interlock compromised its IT backbone."[4] The operational impact: "Emergency patients were diverted, procedures delayed, and recovery took more than two weeks."[4] BlackFog cites experts who concluded "inadequate network segmentation" allowed the ransomware to propagate across the hospital network.[4]

Texas Tech University Health Sciences Center (October 2024)

Texas Tech University Health Sciences Center, an education and health sciences institution in West Texas, appears on the Interlock leak site dated 2024-10-27.[2] The Interlock crew's listing describes the institution as "Beginning in 1969 as the Texas Tech University School of Medicine, Texas Tech University Health Scie..." (truncated on the leak-site snapshot).[2]

Brockton Neighborhood Health Center (December 2024)

Brockton Neighborhood Health Center, a Massachusetts community health center, is dated 2024-12-17 on the leak site, which describes it as "a multicultural organization that collaborates with community..." (truncated).[2] The institution serves a diverse patient population in the Brockton area south of Boston.

Wayne County, Michigan (October 2024, March 2025)

Wayne County, Michigan appears twice on the leak site: 2024-10-23 and again 2025-03-01.[2] The duplication suggests two separate entries for the same target. Wayne County is the most populous county in Michigan, and it surrounds the city of Detroit.

City of St Paul, Minnesota (August 2025)

The City of St Paul, Minnesota appears on the Interlock leak site dated 2025-08-11.[2] St Paul is the state capital and Minnesota's second-largest city. The leak-site entry is short and does not include specific operational detail.

Salvation Army (December 2025)

The Salvation Army, the international charitable organization, appears on the leak site dated 2025-12-24.[2] The Interlock entry describes the organization as "established in 1865, has been offering an array of social services that range fr..." (truncated).[2]

District of Columbia Housing Authority (July 2026)

The District of Columbia Housing Authority (DCHA), the public housing agency for Washington DC, is dated 2026-07-16 on the leak site.[2] DCHA manages public housing for low-income residents and administers the federal Housing Choice Voucher program locally.

Springfield Public Schools (September 2026)

Springfield Public Schools in Springfield, Massachusetts is dated 2026-09-15.[2] The leak site describes it as "the third-largest school district in th..." (truncated).[2]

University of Warsaw (April 2026)

Uniwersytet Warszawski, the University of Warsaw in Poland, is dated 2026-04-15 on the leak site.[2] It is the largest university in Poland.

City of Fort Smith, Arkansas (September 2026)

The City of Fort Smith, Arkansas is dated 2026-09-15 on the leak site.[2] Fort Smith is the second-largest city in Arkansas.

Heritage Bank (December 2024)

Heritage Bank, flagged with an Australian country code, is dated 2024-12-17 on the leak site.[2] The Interlock entry describes "Heritage Bank USA provides commercial banking services. Heritage offers a broad line of banking and..." (truncated).[2]

Reynella East College (June 2026)

Reynella East College, an Australian secondary school, is dated 2026-06-23.[2]

Waterford Hotel Group (May 2026)

Waterford Hotel Group, an Irish hospitality company, is dated 2026-05-11.[2] The Interlock entry describes it as "a company that manages hotels and conference centers [that] failed to implement adequat..." (truncated).[2]

Other named victims (selected, by sector)

The leak site lists additional named victims across multiple sectors through October 21, 2026.[2] Healthcare: Weisman Children's (2025-08-04), Riviera Healthcare Center (2026-10-07), The Center for Kidney Care (2026-09-28), Concord Eye Center (2026-10-12), O2 Dental Group (2026-10-05), Park Dental Research (2026-05-11), Apex Spine and Neurosurgery (2026-01-06), Issaqueena Pediatric Dentistry (2025-11-24), Clearview Eye Centre (CA, 2026-06-25), Naper Grove Vision Care (2025-06-02), Family Health Specialists (2025-06-02), Legacy Treatment Services (2024-10-26), and The Center for Hearing & Speech (2026-04-02).[2] Schools and education: Southeastern Oklahoma State University (2026-08-19), Bishop Ireton High School (2025-11-03), Clarksville ISD (2025-12-18), Borger ISD (2026-07-10), Kearney Public Schools (2025-10-15), North Stonington School District (2025-10-15), Pequannock Township School District (2025-08-15), Aztec Municipal School District (2025-03-22), Cherokee County School District (2025-04-04), Madison School District Schools (2025-04-25), Lexington & Richland County School District Five (2025-06-24), Central Point School District 6 (2025-06-13), Wagon Mound Public Schools (2026-03-09), Odyssey Academy (2026-02-01), Westlake Christian Academy (2026-01-07), Shalom Christian Academy (2026-10-09), Loyola College (AU, 2025-08-29), Providence Academy (2025-12-03), and Christian Brothers Academy (2025-06-12).[2] Government and city: Winona County (US, 2026-05-01), Fargo Park District (2025-12-05), Centre for Newcomers (CA, 2026-07-17), Box Elder County (US, 2025-08-13), West Lothian Council (GB, 2025-05-23), Boston Chinatown Neighborhood Center (2024-12-09), City of Noblesville (2024-12-20), City of Peabody, MA (2025-07-18), Kent District Library (2026-05-11), and Shelbyville Police Department (2025-11-05).[2] Manufacturing: Pedigo Products, Inc. (2026-10-12), Engineers Contractors Fabricators Inc. (ECF) (2026-10-12), H&L Manufacturing (2026-10-05), Delta Manufacturing (2026-03-18), Aero Fabrications (2026-01-06), Print-O-Tape (2025-12-15), Bentley Industries (2025-05-05), Janco Steel (CA, 2025-05-01), General Formulations (2025-03-23), The Smeg Group (IT, 2025-03-01), Smeg (IT, 2024-10-24), and Huntwood Industries (2025-08-25).[2] Financial, legal, and professional services: NFM Lending (2026-09-07), Cathexis Holdings LP (2024-10-13), MBM Intellectual Property Law (CA, 2025-08-11), Anderson & Karrenberg (2025-07-18), Pinto Coates Kyre & Bowers (AU, 2025-11-03), Swartz Campbell (2025-12-22), Hunneman (2025-12-31), and Semple, Marchal & Cooper, LLP (2025-06-03).[2] Retail and hospitality: Nu-Quest Distribution Inc (2026-10-12), YMCA of Western North Carolina (2026-07-07), Goodwill (2026-03-26), First United Methodist Church Boerne (2026-05-11), Lonestar Truck Group & Tag Truck Center (2026-05-04), Cold Front Distribution (2026-06-02), Andretti Indoor Karting & Games (2025-04-07), Pocono Farms Country Club (2025-08-25), and Wilsonville Toyota-Scion (2025-06-25).[2]

More names on the leak-site roster, as of October 21, 2026, include Greentech Environmental, Paragon Store Fixtures, Converting Equipment International, Super Systems Inc, Connell Enterprises LLC, AngMar Companies, Gardiner Family Chiropractic, Blaise C. Bender PC, Tekko Enterprises, Inc., Accident Injury Solicitors (GB), Wier Boerner Allin, Epperson Law Group, WC Smith, Rechler Equity Partners, A/C Supply, Kalamazoo Public School District, Semple & Cooper (GB), Fowler Elementary School, Doman Building Materials Group (CA), Drive Products (CA), Doman (CA), National Defense Corp, PMA (CA), Milano (MX), Hancock Public School, The Siegel Group, Inc., Siegel Group, McCormick & Priore, RJM Marketing, Indesign, LLC, Winnebago Public School Foundation, Drug and Alcohol Treatment Service (AU), Pritchard Brown & Chillicothe Metal, Maki Building Centers, IFPC Worldwide, North Stonington Elementary School, CB Quality Machining & Engineering, Your Building Centers, Positive Solutions (GB), Sacred Heart School, Eagle Builders (CA), In'Tech Industries, Computing Dynamics (GB), Aptura Group & Central Indiana Hardware, Westrian Group, Abbott Media Productions, Yew Tree Dairy (GB), Archaeological Institute of America, Urban Edge Architecture (GB), RGD Consulting Engineers (AU), and Valenti Management (CL).[2]

The Playbook: How Interlock Gets In

The CISA AA25-203A advisory documents nine consistent stages, all confirmed in IBM X-Force's separate research and in the BlackFog analysis.[1][3][4]

  • Drive-by downloads from poisoned legitimate sites. CISA: "Interlock actors obtain initial access by compromising a legitimate website that network users visit, or by disguising malicious payloads as fake browser updates or common security software." The lure filenames the advisory lists are FortiClient.exe, Ivanti-Secure-Access-Client.exe, GlobalProtect.exe, Webex.exe, AnyConnectVPN.exe, and Cisco-Secure-Client.exe.[1] BlackFog adds: "The gang leverages drive-by download attacks from compromised websites, often disguised as fake browser updater ransomware installers. Victims believe they are running a legitimate Chrome or Edge update, but in reality, they execute a hidden PowerShell payload."[4]
  • ClickFix fake-CAPTCHA social engineering. CISA: "InterLock actors use ClickFix [T1204.004] techniques to gain initial access, which involves tricking users into executing Base64-encoded PowerShell commands by interacting with a fake CAPTCHA page."[1] BlackFog: "Users land on a fraudulent CAPTCHA or error page instructing them to press certain keys. The keystrokes paste and run malicious code via the Windows Run dialog, meaning the victim essentially installs the malware for the attacker."[4]
  • Fake Chrome RAT as the first-stage payload. CISA: "InterLock actors delivered a fake Chrome or Edge executable via PowerShell that operates as a remote access tool (RAT) [T1105, T1059.001]. PowerShell scripts drop files into the Windows Startup folder and add registry Run keys for persistence [T1547.001]. Persistence is also established through a Run registry key named 'Chrome Updater' [T1036.005]."[1] IBM X-Force identifies the second-stage backdoor as InterlockRAT, with command codes for SOCKS5 proxy, terminal, file transfer, sleep, and self-update.[3]
  • NodeSnake, a JavaScript backdoor that mostly downloads. IBM X-Force: "NodeSnake is a malware that was first identified in January 2025."[3] Google Threat Intelligence tracks NodeSnake as CORNFLAKE.[3] IBM describes it as "a persistent backdoor" that "mainly functions as a downloader for second stage malware such as InterlockRAT or Supper."[3] Its commands include EXE, DLL, JS, SHELL_COMMAND, ACTIVE, AUTORUN, OFF, UPDATE, and SCREENSHOT, with the screenshot command as the most recent addition.[3] IBM concludes the shared tooling is "indicating a shared original codebase or possibly common developers."[3]
  • Living-off-the-land lateral movement. CISA: "Reconnaissance commands include WindowsIdentity.GetCurrent(), systeminfo, tasklist /svc, Get-Service, Get-PSDrive, arp -a. InterLock actors used Cobalt Strike, SystemBC, Interlock RAT, NodeSnake RAT for command and control [TA0011]. For lateral movement, InterLock actors leveraged RDP [T1021.001], AnyDesk, and PuTTY. Possible Kerberoasting attacks [T1558.003] against domain controllers have also been observed."[1] Credential theft uses a stealer named cht.exe and a keylogger klg.dll, with Lumma Stealer and Berserk Stealer also observed in some environments.[1]
  • Cloud-native exfiltration through Azure. CISA: "InterLock actors used Azure Storage Explorer [StorageExplorer.exe] and AzCopy to navigate and upload data to Azure blob storage [T1530, T1567.002]. WinSCP and other file transfer tools are also used [T1048]."[1] BlackFog: "Interlock is notable for using cloud-native tools: it has employed Microsoft's Storage Explorer and AzCopy to funnel gigabytes of data into attacker-controlled Azure blob containers."[4]
  • Encryption, ransom, and self-cleanup. CISA: the encryption binary is "a 64-bit executable named conhost.exe", and "Encryptors are designed to encrypt files using a combined Advanced Encryption Standard (AES) and Rivest-Shamir-Adleman (RSA) algorithm." Encrypted files "are appended with either a .interlock or .1nt3rlock file extension, alongside a ransom note titled !__README__!.txt delivered via group policy object (GPO)." Ransom notes do not include an initial ransom demand or payment instructions; instead, victims are provided with a unique code.[1] Victims are directed to contact actors via a .onion Tor URL with payment demanded in Bitcoin.[1] After encryption, "A DLL named tmp41.wasd is used to delete the encryption binary post-execution."[1]
  • Long dwell time before encryption. BlackFog notes Interlock attackers "have been observed dwelling in networks for weeks, creating a long ransomware forensic timeline before encryption begins," with one incident showing attackers present for "up to 17 days" before triggering the encryptor.[4]
  • Code reuse with Rhysida / Vanilla Tempest. IBM X-Force: "Over the past two years, X-Force research indicates a relationship or lineage between Interlock and Rhysida actors. However, the exact nature of this relationship remains unknown."[3] Rhysida is tracked by Microsoft as Vanilla Tempest; IBM documents shared malware families and infrastructure between the two operations.[3]

The single most consistent lesson is the front door. The attacker tricks a human into running a fake browser update or pasting a malicious PowerShell command into the Run dialog, then a fake Chrome binary establishes persistence, then the NodeSnake backdoor pulls down InterlockRAT or Supper, then Azure-native tools quietly exfiltrate data to attacker-controlled blob containers, then the encryptor fires.[1][3][4] CISA's AA25-203A recommendations run in this order: "Implement DNS filtering," "Implement web access firewalls," "Train users to identify, avoid, and report social engineering attempts," deploying EDR across VMs, systems, and networks, "Segment networks to prevent ransomware spread," "Keep operating systems, software, and firmware updated; prioritize known exploited vulnerabilities," "Require MFA wherever possible, especially for webmail, VPNs, and critical systems; implement ICAM policies first," "Filter network traffic so unknown or untrusted origins cannot access internal remote services," "Review domain controllers, servers, workstations, and Active Directory for unfamiliar accounts," "Disable unused ports," "Disable command-line and scripting activities and permissions," "Use time-based/JIT privileged access," "Maintain offline backups and test maintenance and restoration," and "Encrypt backups, make them immutable, and cover the entire data infrastructure."[1]

What You Can Do If Interlock Is A Threat To You

Your direct risk depends on whether you or your employer runs a public-facing web application, a help desk that takes phone-based reset requests, or an environment that uses Azure storage in a way that allows an attacker with user credentials to upload large files. Different Interlock victims live on different layers of that stack.

  • If your organization runs an internet-facing site or portal: Interlock's drive-by vector poisons legitimate websites and serves fake browser or VPN-client updates from the victim's own browser session.[1] Push DNS filtering and a web access firewall in front of every employee browser and every public-facing application. The CISA advisory lists DNS filtering first.[1] Patch every known exploited CVE on internet-facing appliances. IBM X-Force's research found that Interlock-related infections "have consistently been tied to one TDS in particular, tracked by Recorded Future as TAG-124 (overlapping with LandUpdate808 and KongTuke)."[3]
  • If your users touch a web browser or a Windows Run dialog: ClickFix and FileFix trick the user into pasting PowerShell or a file path into a system dialog.[1][4] BlackFog's recommendation: "Train users on lures like the ClickFix technique and FileFix social engineering, awareness is the first line of defense."[4] Disable PowerShell for non-administrative users where you can. Constrain the Windows Run dialog. Treat any unexpected "verification" prompt that involves pasting commands as malicious until proven otherwise.
  • If you operate Azure: Interlock uses Azure Storage Explorer and AzCopy to upload gigabytes of victim data to attacker-controlled blob containers.[1][4] Alert on any unusual AzCopy invocation from a user endpoint. Alert on Storage Explorer running from a non-administrator workstation. Apply Conditional Access to require compliant devices for any user with rights to create or upload to storage accounts. Watch for the NodeSnake RAT and InterlockRAT second-stage loaders.[3]
  • If you run virtual machines at scale: CISA notes the Interlock encryptors "have been observed encrypting virtual machines (VMs) across both operating systems."[1] Put EDR on every VM host, not just the management plane. Maintain offline, immutable, encrypted backups. Segment the VM management network from the corporate network. Test VM restore from backup on a schedule shorter than your dwell-time assumption (BlackFog documents 17 days of dwell).[4]
  • If you operate a healthcare, education, or local-government network: you are over-represented on the Interlock leak site.[2] The April 2025 DaVita breach exposed data on 2.7 million people.[5] Kettering Health took more than two weeks to recover.[4] The District of Columbia Housing Authority (July 2026), the City of St Paul (August 2025), the City of Fort Smith Arkansas (September 2026), and the University of Warsaw (April 2026) are all listed on the leak site.[2] Audit your help desk's phone verification process, your Azure upload paths, and your VM segmentation in that order.
  • If your data was already posted to the leak site: do not pay to keep it off the internet. CISA's AA25-203A states it plainly: "The authoring agencies do not encourage paying ransom as payment does not guarantee victim files will be recovered."[1] Treat the data as compromised: rotate credentials, reissue MFA factors on a clean device, monitor for credential-stuffing attempts using the leaked email/username lists, and notify the relevant regulator (HHS for healthcare, the state attorney general, the SEC if you are a public company).
  • If you have credible information on the operation: the FBI is investigating. AA25-203A lists the FBI IC3, CISA's 1-844-Say-CISA line, MS-ISAC's [email protected] for SLTT entities, and [email protected] for healthcare organizations as the official reporting channels.[1]

If you are a security or IT lead, the highest-impact change is to map your exposure against the AA25-203A IoC list (the SHA-256 hashes it publishes for the encryptor binary and for the credential stealer and keylogger) and against IBM X-Force's IOC repository for NodeSnake and InterlockRAT before the next inbound ClickFix lure hits your help desk. The second highest-impact change is to enforce phishing-resistant MFA on every admin and every help-desk user, restrict AzCopy and Storage Explorer to administrator workstations, and require manager co-approval for any new MFA factor enrollment.

The Honest Takeaway

Interlock is not a novel exploit chain. It is the same double-extortion ransomware playbook that the industry has been writing about for a decade, dressed up in two unusually effective lures (ClickFix and the fake browser-update drive-by) and a malware family (NodeSnake, InterlockRAT, Supper) that IBM X-Force ties to Rhysida operators through shared code.[3] What is new is the operational tempo. CISA's AA25-203A confirms encryptors that hit Windows, Linux, and FreeBSD, a focus on virtual machines, a willingness to dwell for weeks before encryption, and an Azure-native exfiltration path that slips past traditional network DLP.[1][4]

The public record on named victims is large but uneven. CISA's advisory does not name specific victims or ransom amounts; the public tally is mostly the leak-site rosters aggregated by ransomware.live.[1][2] The DaVita disclosure, 2.7 million people, is the largest single confirmed patient count.[5] IBM X-Force notes the broader operation "has claimed around 80 victims each in 2025, with the majority located in the US," though that figure covers Interlock and Rhysida together.[3] The leak site through October 21, 2026 shows a sustained pace into 2026, with named victims in healthcare, education, government, manufacturing, financial services, and law firms across North America, Europe, South America, and Australia, and none in Asia or Africa.[2]

What does not change is the front door. The 2026 attacker tricks a human into running a fake browser update or pasting a malicious PowerShell command into the Run dialog, then a fake Chrome binary establishes persistence, then the NodeSnake backdoor fetches InterlockRAT, then Azure-native tools quietly exfiltrate data to attacker-controlled blob containers, then the encryptor fires.[1][3][4] Phishing-resistant MFA on every admin breaks the second hop. DNS filtering and a web access firewall break the first. Disabling PowerShell for non-admins breaks the third. Auditing AzCopy breaks the fourth. The fix is a checklist, not a product, and the checklist is in CISA's AA25-203A.[1]

The sources on this page cover Interlock activity documented in the CISA / FBI / HHS / MS-ISAC joint advisory AA25-203A (July 22, 2025), the leak-site tracker on ransomware.live (through October 21, 2026), IBM X-Force's long-form research on the Interlock / Rhysida / Vanilla Tempest code overlap (June 12, 2026), BlackFog's industry analysis of the operation's evolution (September 17, 2025), and Healthcare Dive's reporting on the DaVita disclosure (August 22, 2025). The leak-site dates are publication dates, not intrusion dates. The list is not complete; Interlock's footprint includes additional victims whose names were posted on the leak site after this page was last updated.

Sources

  1. CISA, FBI, HHS, MS-ISAC, #StopRansomware: Interlock (Advisory AA25-203A, July 22, 2025)
  2. ransomware.live, Interlock group victim list (snapshot through October 21, 2026)
  3. IBM X-Force, Interlock and Rhysida within the ransomware ecosystem (June 12, 2026)
  4. BlackFog, The Interlock Ransomware Problem Security Teams Can't Ignore (September 17, 2025)
  5. Healthcare Dive, Ransomware attack on DaVita exposes data from 2.7M (August 22, 2025)

Published: October 16, 2026