• First observed: September 2024
  • Model: Believed to operate outside the classic RaaS affiliate model, appears to run its own attacks directly
  • Status: Active and escalating

 

Origin

First identified in September 2024 by researchers at the French threat intelligence firm Sekoia, the group has steadily gained notoriety. TECHi's coverage of the group's emergence noted that, "According to Sekoia, Interlock first surfaced in September 2024 and runs its own data leak site called ‘Worldwide Secrets Blog,’ operating through a structured, multi-stage attack chain that begins by deceiving users into visiting a compromised website.”

By mid-2025, French cybersecurity outlet SOS Ransomware was already describing Interlock's trajectory as something to watch out for, noting, "Its meteoric rise to prominence has been illustrated by devastating attacks on major institutions including Texas Tech University, DaVita Inc, Kettering Health, and more recently the defense contractor AMTEC/National Defense Corporation.”

Interlock's healthcare targeting wasn't a one-off. Healthcare IT News reported that industry groups had flagged the pattern early, noting, "The Chicago Health System Coalition said last year it believed Interlock was aggressively targeting healthcare organizations, while researchers at Cisco's Talos Intelligence described in a November blog post how an Interlock threat actor conducting "big-game hunting" remained inside a victim's environment for approximately 17 days before deploying the ransomware payload.”

 

An unusual way in

What sets Interlock apart technically isn't the ransomware payload itself, it's how the group does its attacks. Rather than relying primarily on phishing emails or purchased network access like some ransomware groups, Interlock has leaned on tricking users directly. An article from Paubox described the technique, stating, "The FBI described Interlock's initial tactics as ‘uncommon’ among ransomware groups, citing drive-by downloads from compromised but otherwise legitimate websites, where attackers disguise malicious payloads as fake browser updates for Google Chrome or Microsoft Edge.” The group has also adopted newer social-engineering tools, using "’ClickFix,’ which deceives users into executing malicious code under the pretense of fixing a system error, and a variant called ‘FileFix’ that uses native Windows elements to deploy malware, including remote access trojans, while avoiding security detection.”

SOS Ransomware's technical breakdown of the group's tooling reinforced this pattern, noting that Interlock's affiliates or operators favor PowerShell as their primary attack vector, which is why the outlet recommends "securing PowerShell execution as the first line of defense, using AppLocker to precisely control which applications can run and blocking unauthorized PowerShell scripts from suspicious locations.”

 

Who is Interlock linked to?

Interlock emerged with no obvious link, but researchers have spent the past two years tracing its overlaps with other groups. The strongest connection is to Rhysida. In its early analysis, Cisco Talos assessed, with low confidence, that Interlock is likely a new diversified group that emerged from Rhysida operators or developers, based on similarities in tactics, techniques, and procedures. Talos also pointed to overlapping techniques, tools and even code. US authorities noticed too. The agencies behind the joint #StopRansomware advisory on Interlock said they were aware of open-source reporting on similarities between the Rhysida and Interlock variants. Antiy’s analysts laid out the competing theories that Interlock could be an affiliate of Rhysida, Rhysida could have built it by passing on its technology and tactics, or some Rhysida members could have split off to form it.

IBM X-Force’s research does not conclude they are the same group. Instead, it maps what they share. Rhysida has run as ransomware-as-a-service since at least May 2023, while Interlock (which X-Force tracks as Hive0163) has operated since September 2024. The overlap is in the supporting toolkit. A backdoor called Supper was used in both groups’ incidents, crypted with each group’s own preferred crypter (JunkFiction for Interlock, Tomb for Rhysida). Interlock relies mostly on custom malware, including NodeSnake and InterlockRAT, while Rhysida actors often use the Broomstick (Oyster) backdoor. That suggests shared suppliers or shared developers rather than a rebrand.

Rhysida itself has a lineage. A joint FBI and CISA advisory in 2023 noted similarities between Vice Society (tracked by Microsoft as DEV-0832) and the actors deploying Rhysida. Cyble has drawn the same line from Interlock back to Vice Society, also known as Vanilla Tempest. If the theories hold, Interlock may be the latest stage of a family of operators that has changed names repeatedly.

 

Texas Tech

One of Interlock's first major healthcare targets came in 2024, when it breached Texas Tech University Health Sciences Center. SOS Ransomware's profile of the group described the scope, stating, "The attack exposed the personal and medical data of 1.4 million patients, including diagnostic, treatment, and financial information, and perfectly illustrated Interlock's ability to penetrate complex hospital information systems and exfiltrate huge volumes of sensitive data.”

 

DaVita: A warning sign for dialysis patients

In April 2025, Interlock attacked DaVita, one of the largest dialysis treatment providers in the United States, serving hundreds of thousands of patients who depend on regular treatment to stay alive. The Record's coverage of the subsequent Kettering Health incident noted the DaVita attack as a marker of Interlock's growing ambition, observing that "the group caused alarm in April after shutting down the network of dialysis treatment company DaVita, having previously attacked the Texas Tech University Health Sciences Center as well as its El Paso counterpart.”

Read also: DaVita agrees to $15M ransomware settlement

 

Kettering Health: Interlock's biggest healthcare target yet

Interlock's most consequential healthcare attack to date came in May 2025, against Kettering Health, a 14-hospital, 120-outpatient-facility nonprofit system serving the Dayton, Ohio area. BleepingComputer's reporting noted the scale of the organization affected, "Kettering Health employs over 15,000 people, including more than 1,800 physicians, and manages 14 medical centers and over 120 outpatient facilities in western Ohio.”

According to threat monitoring firm BlackFog's incident timeline, "Kettering Health detected the outage on May 20, 2025, weeks after investigators later traced the initial breach back to April 9; around 600 applications went offline, including the Epic electronic health record system, the MyChart patient portal, and phone lines, forcing every elective inpatient and outpatient procedure to be canceled and ambulances to be diverted for about a week.”

The disruption to care delivery pushed staff back to manual processes. Healthcare Dive reported the health system said "it has reason to believe that the attack, which began in late May and disrupted patient care, was launched by the ransomware group Interlock, an emerging group that had already targeted several sectors including healthcare, according to a Cisco Talos report published in November.”

The fallout also created a secondary danger for patients besides the technical outage. Healthcare IT News reported that "the attack quickly led to a scam targeting patients, during which persons claiming to be billing team members called by phone demanding payments, forcing the health system to temporarily suspend its billing activities altogether.” The same report noted the attack led to the stopping of "radiation oncology treatments for a week and shut down the health system's call center and text messaging services.”

When Kettering declined to pay a ransom, Interlock followed through on its extortion threat. BleepingComputer reported, "The ransomware group claimed to have stolen 941 GB of data, including over 20,000 folders containing 732,489 documents with sensitive information, allegedly including bank reports, payroll information, patient data, pharmacy and blood bank documents, Kettering Health police personnel files, and scans of identity documents including passports.”

Paubox reported the final breach count, confirmed with HHS, reached 1,695,382 individuals. Kettering's leadership was left to explain the aftermath to the public. In a statement quoted by The Record, the health system said, "A thorough review of all systems was conducted by external partners and our internal team, and all necessary security protocols, including network segmentation, enhanced monitoring, and updated access controls" had been implemented.

 

FAQs

What is a drive-by download?

A drive-by download is a malware infection that occurs when someone visits a compromised website, often without realizing anything has been installed.

 

What is “big-game hunting” in cybercrime?

Big-game hunting means targeting large, high-value organizations, which can pay bigger ransoms, instead of attacking victims at random.

 

Why are hospitals and healthcare providers such common ransomware targets?

Healthcare organizations hold highly sensitive data and can’t afford long outages, which makes them more likely to pay and more damaging to attack.

 

What is the difference between a threat group “rebrand” and a “spin-off”?

A rebrand is the same group operating under a new name, while a spin-off is when some members or developers split off to form a separate group.