Interlock Ransomware Weaponizes Incident Response Tools for Credential Theft
The Interlock ransomware group, also known as GOLD EMBRACE, is now using legitimate Windows incident response tools like Volatility3 and WinPmem to steal password hashes and account data, complicating detection efforts.
The Interlock ransomware group, operating under the alias GOLD EMBRACE, has adopted a sophisticated and deceptive tactic by weaponizing common Windows incident response and memory analysis tools. Instead of relying solely on custom malware, attackers are now leveraging legitimate utilities such as Volatility3 and WinPmem to extract sensitive credential data, including NTLM and legacy LM password hashes, as well as local account information. This strategy allows them to operate with a degree of stealth, as the presence of these tools might not immediately trigger alarms in security monitoring systems that expect them during legitimate forensic investigations.
The group's attack chain typically begins with social engineering, often through compromised websites or deceptive prompts that lure users into executing malicious code. In a recent observed incident, a user searching for business software on ChatGPT was directed to a compromised legitimate website. A "ClickFix" prompt then convinced the user to run a command in the Windows Run dialog, initiating the download of PowerShell code and a remote-access payload. This initial compromise on an unprotected Windows 10 endpoint quickly escalated.
Within approximately 26 hours, the attackers moved from the initial workstation to a domain controller. Their post-compromise activities included querying directory information, performing Kerberoasting attacks to obtain service account passwords, and executing an anonymous NTLM downgrade attack for lateral movement. By the third day, they had escalated privileges to a domain administrator account, using it to create a scheduled task on a print server, demonstrating a rapid progression towards full network control.
The impact of these attacks is severe, encompassing credential dumping, the creation of new domain administrator accounts, tampering with security software, exfiltration of sensitive files, and ultimately, data encryption and ransomware deployment. The attackers also threaten to publish stolen data if their ransom demands are not met. Interlock has also been observed pursuing zero-day vulnerabilities, such as a critical flaw in Cisco firewall management, indicating a willingness to combine novel exploits with their established tactics.
Sophos analysts, who identified this activity during a March 2026 investigation, noted that Interlock has been active since September 2024, primarily targeting organizations in North America and Europe, with a focus on critical infrastructure, healthcare, and education sectors. The group's operational model combines data theft with encryption, a common but effective double extortion strategy.
This tactic of repurposing legitimate tools poses a significant challenge for defenders. Security teams must enhance their endpoint protection, implement strict controls over the execution of administrative and forensic utilities, and establish robust alerting for unexpected memory acquisition or hash-dumping activities. Verifying the legitimacy of tool execution and monitoring for unusual PowerShell commands or domain queries are crucial steps in early detection.
Interlock's toolset also includes custom malware such as NodeSnake and InterlockRAT. The group's connection to the Rhysida ransomware operation further underscores the importance of tracking attacker behavior across all stages of an intrusion, rather than relying solely on specific malware names or signatures.
Organizations are advised to maintain up-to-date asset inventories, regularly review application control policies, test their backups, and ensure all systems, particularly internet-facing ones like Cisco firewalls, are promptly patched to mitigate risks associated with both known and novel exploitation techniques.