Interlock Ransomware Strikes: A New Strain Is Wrecking Havoc in North America and Europe

The AhnLab Security Emergency Response Center (ASEC) has published new research on the Interlock ransomware group, which has been conducting continuous attacks against organisations across multiple industries and critical infrastructure sectors in both North America and Europe since late 2024.

According to AhnLab, “Interlock ransomware group first emerged at the end of September 2024, and has been continuously attacking various businesses and critical infrastructures in North America and Europe.” The gang uses double extortion, encrypting files and exfiltrating data to threaten public leaks if victims do not pay, with a darknet leak site publishing stolen data from non-compliant organisations.

It employs a sophisticated encryption model—the AES-256-GCM algorithm to encrypt files, with the symmetric key and IV encrypted using a RSA-4096 public key and inserted at the end of the file. The encryption relies on the OpenSSL library and leaves no network activity clues for forensic investigators, while the malware conceals its main code through obfuscation and runtime patching to evade detection.

Encrypted files receive the “.!NT3RLOCK” extension, and ransom notes named OPEN_BEFORE_ANYTHING.txt are left behind, with victims directed to a Tor-based negotiation portal.