Skip to content
OriginalSign in
Image: SecurityOnline

SecurityOnlineDo Son

IBM X Force ties Interlock and Rhysida ransomware via tools

Part of the Interlock story · since 2 Apr

Quiet for 9 weekslast report 28 Aug5 articles4 outlets
2 Apr · Security Affairs first18 Jul23 Aug28 SepNowThis article3rd of 5
  • Thu 2 Apr, 17:52 UTC. Security Affairs, first report. Cisco fixed critical and high-severity flaws.
  • Mon 18 May, 12:11 UTC. Securelist, its first report on the story. Kaspersky blocks 343M attacks as ransomware variants surge in Q1 2026. Cites a CVE in CISA KEV.
  • Fri 19 Jun, 10:06 UTC. SecurityOnline, its first report on the story. IBM X Force ties Interlock and Rhysida ransomware via tools. This article, 3rd of 5.
  • Mon 10 Aug, 08:01 UTC. SecurityOnline. Interlock Ransomware Abuses Volatility3 for Credential Theft.
  • Fri 28 Aug, 14:16 UTC. DataBreaches, its first report on the story. Winona County Pays $128,500 After Ransomware Attack.

IBM X-Force's research reveals a two-year overview of the Interlock and Rhysida ransomware ecosystem, detailing connections between initial-access brokers, crypters, and backdoors. Interlock has been active since September 2024, using a custom toolkit, while Rhysida has operated as Ransomware-as-a-Service since May 2023. Both groups reported around 80 victims, predominantly in the U.S., with Interlock targeting education and Rhysida focusing on manufacturing.

The study suggests a potential lineage between the two, supported by shared malware such as the Supper backdoor and similarities in coding across various tools. Initial-access brokers and edge device exploitation are highlighted as significant aspects, with defenses recommended against the full chain of ransomware operations.

How the story developed

All 5 articles
Quiet for 9 weekslast report 28 Aug5 articles4 outlets

5 articles from 4 outlets since 2 Apr. Quiet since 28 Aug. This was the 3rd report, 78 days after the first.

Now2 Apr16 May29511188 Aug1927First reportSecurity Affairs · 2 Apr, 17:52This article3rd of 5 · day 78
  • Thu 2 Apr, 17:52 UTC. Security Affairs, first report. Cisco fixed critical and high-severity flaws.
  • Mon 18 May, 12:11 UTC. Securelist, its first report on the story. Kaspersky blocks 343M attacks as ransomware variants surge in Q1 2026. Cites a CVE in CISA KEV.
  • Fri 19 Jun, 10:06 UTC. SecurityOnline, its first report on the story. IBM X Force ties Interlock and Rhysida ransomware via tools. This article, 3rd of 5.
  • Mon 10 Aug, 08:01 UTC. SecurityOnline. Interlock Ransomware Abuses Volatility3 for Credential Theft.
  • Fri 28 Aug, 14:16 UTC. DataBreaches, its first report on the story. Winona County Pays $128,500 After Ransomware Attack.
  • Known exploited CVE
  • CVE not in KEV
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 5 articles as a list
  1. Thu 2 AprDay 01
    1. Cisco fixed critical and high-severity flaws17:52 · Security Affairs · First report

  2. Quiet for 7 weeks

    Mon 18 MayDay 461
    1. Kaspersky blocks 343M attacks as ransomware variants surge in Q1 202612:11 · Securelist · Exploited CVE · Picked up again · Known exploited CVE

  3. Quiet for 5 weeks

    Fri 19 JunDay 781
    1. IBM X Force ties Interlock and Rhysida ransomware via tools10:06 · SecurityOnline · Picked up again · This article, 3rd of 5

  4. Quiet for 7 weeks

    Mon 10 AugDay 1301
    1. Interlock Ransomware Abuses Volatility3 for Credential Theft08:01 · SecurityOnline · Picked up again

  5. Quiet for 3 weeks

    Fri 28 AugDay 1481
    1. Winona County Pays $128,500 After Ransomware Attack14:16 · DataBreaches · Picked up again

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in