Interlock and Rhysida: AI in the Ransomware Ecosystem

SOC Prime Team

Interlock and Rhysida: AI in the Ransomware Ecosystem

Detection stack

AIDR
Alert
ETL
Query

Threat Report
Attack Flow
Detections
Simulations

Summary

IBM X-Force research highlights a strong connection between the Interlock (Hive0163) and Rhysida ransomware ecosystems. The report outlines an intricate network of shared malware families, specialized crypters, and coordinated initial access brokers. Interlock appears to be a highly mature threat group using custom tooling such as NodeSnake and InterlockRAT, and it may have evolved from operators previously associated with Rhysida.

Investigation

X-Force carried out long-term research over more than two years, analyzing malware samples, attack chains, and staging infrastructure. The investigation uncovered substantial code similarities across multiple backdoors and tracked the development of dedicated crypters such as JunkFiction and Tomb. Researchers also mapped ties between threat actors and initial access brokers through overlapping infrastructure and tool usage.

Mitigation

Organizations should deploy strong endpoint detection and response capabilities to identify suspicious process behavior, including unexpected PowerShell activity and unauthorized registry changes. Prompt patching of internet-facing network devices is essential to reduce the risk of exploitation, including vulnerabilities such as CVE-2026-20131. Enforcing strict WDAC controls and monitoring for unapproved RMM tool activity can also limit post-compromise operations.

Response

If Interlock or Rhysida activity is suspected, isolate impacted systems immediately to stop lateral movement through RDP or SOCKS5 tunnels. Conduct a thorough review of staging infrastructure and check for unauthorized remote management tools such as ConnectWise ScreenConnect. Review logs for suspicious PowerShell execution and investigate any unauthorized changes involving scheduled tasks or systemd services.

"graph TB %% Class Definitions classDef initial_access fill:#f96,stroke:#333,stroke-width:2px classDef evasion fill:#bbf,stroke:#333,stroke-width:2px classDef execution fill:#dfd,stroke:#333,stroke-width:2px classDef persistence fill:#fdd,stroke:#333,stroke-width:2px classDef command_control fill:#ffd,stroke:#333,stroke-width:2px classDef discovery fill:#dff,stroke:#333,stroke-width:2px classDef lateral_movement fill:#dcd,stroke:#333,stroke-width:2px classDef impact fill:#f99,stroke:#333,stroke-width:2px classDef tool_malware fill:#eee,stroke:#333,stroke-width:1px %% Initial Access Phase action_drive_by["Action – Victims lured via fraudulent websites, malicious ads, or search engine redirects."] class action_drive_by initial_access action_content_injection["Action – Use of Traffic Distribution Systems (TDS) like TAG-124 or ClickFix to redirect users."] class action_content_injection initial_access action_subvert_trust["Action – Using fraudulent certificates like Foshan Yongqiheng Trading Co., Ltd."] class action_subvert_trust evasion %% Execution and Transfer Phase action_user_exec["Action – Execution of trojanized installers (e.g., Microsoft Teams, Chrome, or Edge)."] class action_user_exec execution malware_initial_payload["Malware – JunkFiction, NodeSnake, or Endico Initial stage downloaders executed via user interaction."] class malware_initial_payload tool_malware action_ingress_transfer["Action – Retrieving second-stage malware from remote Command and Control servers."] class action_ingress_transfer execution malware_second_stage["Malware – Supper or InterlockRAT Second-stage backdoors retrieved to facilitate remote access."] class malware_second_stage tool_malware %% Persistence Phase action_persistence_linux["Action – Linux NodeSnake variants creating new systemd services."] class action_persistence_linux persistence action_persistence_windows["Action – Windows Persistence Utilizing shell configuration modifications to maintain a foothold."] class action_persistence_windows persistence %% Command and Control Phase action_c2["Action – Establishing reverse shells and SOCKS5 tunnels for stealthy communication."] class action_c2 command_control %% Discovery Phase action_discovery_domain["Action – Enumerating domain accounts using commands like net user /domain."] class action_discovery_domain discovery action_discovery_groups["Action – Enumerating groups using net group domain admins /domain."] class action_discovery_groups discovery %% Lateral Movement and Impact Phase action_lateral_move["Action – Moving through environment via RDP sessions initiated through reverse shells."] class action_lateral_move lateral_movement action_selective_exclusion["Action – Selective Exclusion Deploying custom WDAC policies to deny Microsoft Defender or Sophos EDR."] class action_selective_exclusion evasion action_impact_encryption["Action – Final deployment of Interlock or Rhysida ransomware to encrypt victim files."] class action_impact_encryption impact %% Connections action_drive_by –>|facilitates| action_content_injection action_content_injection –>|leads_to| action_user_exec action_user_exec –>|uses| malware_initial_payload malware_initial_payload –>|requires| action_subvert_trust malware_initial_payload –>|triggers| action_ingress_transfer action_ingress_transfer –>|downloads| malware_second_stage malware_second_stage –>|establishes| action_persistence_linux malware_second_stage –>|establishes| action_persistence_windows malware_second_stage –>|enables| action_c2 action_c2 –>|performs| action_discovery_domain action_c2 –>|performs| action_discovery_groups action_discovery_domain –>|informs| action_lateral_move action_discovery_groups –>|informs| action_lateral_move action_lateral_move –>|leads_to| action_selective_exclusion action_selective_exclusion –>|precedes| action_impact_encryption "

Interlock and Rhysida: AI in the Ransomware Ecosystem

Summary

Investigation

Mitigation

Response

Attack Flow

Detections

Possible Persistence Points [ASEPs – Software/NTUSER Hive] (via registry_event)

Download or Upload via Powershell (via cmdline)

Possible System Enumeration (via cmdline)

Possible Remote System Discovery or Connectivity Check (via cmdline)

Possible Admin Account or Group Enumeration (via cmdline)

Suspicious Domain Trusts Discovery (via cmdline)

Possible Evasion Checks (via powershell)

Suspicious Binary / Scripts in Autostart Location (via file_event)

Possible Telegram Abuse As Command And Control Channel (via dns_query)

Steam Communtiy DNS Request Perfomed By Suspicious Process (via dns_query)

IOCs (HashSha256) to detect: Security Artificial Intelligence: Interlock and Rhysida within the Ransomware Ecosystem Part 3

IOCs (HashSha256) to detect: Security Artificial Intelligence: Interlock and Rhysida within the Ransomware Ecosystem Part 2

IOCs (HashSha256) to detect: Security Artificial Intelligence: Interlock and Rhysida within the Ransomware Ecosystem Part 1

IOCs (SourceIP) to detect: Security Artificial Intelligence: Interlock and Rhysida within the Ransomware Ecosystem

IOCs (DestinationIP) to detect: Security Artificial Intelligence: Interlock and Rhysida within the Ransomware Ecosystem

JunkFiction Downloader and Scheduled PowerShell Script Detection [Windows Powershell]

Detection of Supper Backdoor and JunkFiction Downloader [Windows Process Creation]

Detection of NodeSnake and InterlockRAT Activity [Linux Process Creation]

Simulation Execution