{"id":11244,"date":"2025-01-28T11:11:13","date_gmt":"2025-01-28T11:11:13","guid":{"rendered":"\/cybersecurity-blog\/?p=11244"},"modified":"2025-02-03T13:13:13","modified_gmt":"2025-02-03T13:13:13","slug":"interlock-ransomware-attack-analysis","status":"publish","type":"post","link":"https:\/\/any.run\/cybersecurity-blog\/interlock-ransomware-attack-analysis\/","title":{"rendered":"Interlock Ransomware: Analysis of Attacks on US Healthcare Providers"},"content":{"rendered":"\n<p>Ransomware attacks have become a relentless threat to the healthcare sector, exposing sensitive patient data, disrupting life-saving treatments, and placing lives at risk. With healthcare systems underfunded and critical infrastructure vulnerable, cybercriminals find this sector an easy and lucrative target.&nbsp;<\/p>\n\n\n\n<p>In recent years, ransomware attacks have not only caused financial losses but have also shaken public trust in healthcare organizations. Hospitals, medical service providers, and even blood donation centers have been hit, leaving a trail of chaos.&nbsp;<\/p>\n\n\n\n<p>This article highlights how healthcare organizations can benefit from <a href=\"https:\/\/any.run\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=interlock_attack&amp;utm_term=280125&amp;utm_content=linktolanding\" target=\"_blank\" rel=\"noreferrer noopener\">ANY.RUN<\/a>&#8216;s Interactive Sandbox and <a href=\"https:\/\/any.run\/cybersecurity-blog\/introducing-any-run-threat-intelligence-lookup\/\" target=\"_blank\" rel=\"noreferrer noopener\">Threat Intelligence Lookup<\/a> to identify, investigate, and analyze ransomware attacks, using a real-world case study of the Interlock ransomware group.&nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">The Impact of Ransomware on Healthcare&nbsp;<\/h2>\n\n\n\n<p>Before we dive deeper into how ANY.RUN helps counter such threats, let\u2019s examine how devastating ransomware attacks can be across the healthcare sector.&nbsp;<\/p>\n\n\n\n<div class=\"wpdt-c row wpDataTableContainerSimpleTable wpDataTables wpDataTablesWrapper\n\"\n    >\n        <table id=\"wpdtSimpleTable-228\"\n           style=\"border-collapse:collapse;\n                   border-spacing:0px;\"\n           class=\"wpdtSimpleTable wpDataTable\"\n           data-column=\"2\"\n           data-rows=\"6\"\n           data-wpID=\"228\"\n           data-responsive=\"0\"\n           data-has-header=\"0\">\n\n                    <tbody>        <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell wpdt-align-left\"\n                                            data-cell-id=\"A1\"\n                    data-col-index=\"0\"\n                    data-row-index=\"0\"\n                    style=\" width:50%;                    padding:10px;\n                    \"\n                    >\n                                        UnitedHealth\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell wpdt-align-left\"\n                                            data-cell-id=\"B1\"\n                    data-col-index=\"1\"\n                    data-row-index=\"0\"\n                    style=\" width:50%;                    padding:10px;\n                    \"\n                    >\n                                        190 million records stolen in the largest healthcare breach\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell wpdt-align-left\"\n                                            data-cell-id=\"A2\"\n                    data-col-index=\"0\"\n                    data-row-index=\"1\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Ascension\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell wpdt-align-left\"\n                                            data-cell-id=\"B2\"\n                    data-col-index=\"1\"\n                    data-row-index=\"1\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        5.6 million patients affected in a Black Basta ransomware attack.\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell wpdt-align-left\"\n                                            data-cell-id=\"A3\"\n                    data-col-index=\"0\"\n                    data-row-index=\"2\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Kootenai Health\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell wpdt-align-left\"\n                                            data-cell-id=\"B3\"\n                    data-col-index=\"1\"\n                    data-row-index=\"2\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        464,000 patient records leaked.\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell wpdt-align-left\"\n                                            data-cell-id=\"A4\"\n                    data-col-index=\"0\"\n                    data-row-index=\"3\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        ConnectOnCall\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell wpdt-align-left\"\n                                            data-cell-id=\"B4\"\n                    data-col-index=\"1\"\n                    data-row-index=\"3\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Exposed the health data of over 910,000 patients in a breach of its SaaS system.\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell wpdt-align-left\"\n                                            data-cell-id=\"A5\"\n                    data-col-index=\"0\"\n                    data-row-index=\"4\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Medusind\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell wpdt-align-left\"\n                                            data-cell-id=\"B5\"\n                    data-col-index=\"1\"\n                    data-row-index=\"4\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        A December 2023 breach impacted 360,000 individuals, exposing sensitive billing and health information.\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell wpdt-align-left\"\n                                            data-cell-id=\"A6\"\n                    data-col-index=\"0\"\n                    data-row-index=\"5\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Anna Jaques Hospital\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell wpdt-align-left\"\n                                            data-cell-id=\"B6\"\n                    data-col-index=\"1\"\n                    data-row-index=\"5\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Ransomware exposed sensitive health data for over 316,000 patients, disrupting critical medical services.\u00a0                    <\/td>\n                                        <\/tr>\n                    <\/table>\n<\/div><style id='wpdt-custom-style-228'>\ntable#wpdtSimpleTable-228{ table-layout: fixed !important; }\ntable#wpdtSimpleTable-228 td, table.wpdtSimpleTable228 th { white-space: normal !important; }\n<\/style>\n\n\n\n\n<h3 class=\"wp-block-heading\">What\u2019s at stake?&nbsp;<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Loss of patient trust:<\/strong> Exposed personal and health information undermines confidence in healthcare providers.&nbsp;<\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Operational disruption:<\/strong> Hospitals and medical facilities are forced to halt services, delaying critical treatments.&nbsp;<\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Financial strain:<\/strong> Organizations face ransom demands, legal fees, and recovery costs, compounding the impact.&nbsp;<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Why Healthcare Is a Prime Target&nbsp;<\/h3>\n\n\n\n<ol start=\"1\" class=\"wp-block-list\">\n<li><strong>Sensitive data<\/strong>: Patient records are incredibly valuable on the black market. Ransomware groups exploit this by encrypting data and demanding payments for decryption.&nbsp;<\/li>\n<\/ol>\n\n\n\n<ol start=\"2\" class=\"wp-block-list\">\n<li><strong>Critical infrastructure<\/strong>: Many healthcare systems cannot afford prolonged downtime due to their role in patient care.&nbsp;<\/li>\n<\/ol>\n\n\n\n<ol start=\"3\" class=\"wp-block-list\">\n<li><strong>Underfunded cybersecurity<\/strong>: Many healthcare providers operate on tight budgets, often prioritizing patient services over robust IT defenses.&nbsp;<\/li>\n<\/ol>\n\n\n\n<ol start=\"4\" class=\"wp-block-list\">\n<li><strong>Slow detection<\/strong>: A common issue is the inability to identify and respond to attacks in their early stages, which allows ransomware to spread undetected.&nbsp;<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">Interlock Group: Active Ransomware Threat to Healthcare&nbsp;<\/h2>\n\n\n\n<p>Interlock is a ransomware actor that engages in double-extortion.&nbsp;<\/p>\n\n\n\n<p>In late 2024, the Interlock ransomware group launched targeted attacks against multiple healthcare facilities in the United States, causing significant disruptions and exposing sensitive patient data:&nbsp;<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Brockton Neighborhood Health Center<\/strong>: Breached on October 20, 2024, undetected until December 17, 2024.&nbsp;<\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Legacy Treatment Services<\/strong>: Attack detected on October 26, 2024.&nbsp;<\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Drug and Alcohol Treatment Service<\/strong>: Breach discovered on October 24, 2024.&nbsp;<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">How ANY.RUN Helps at Different Stages of Interlock Attacks <\/h2>\n\n\n\n<p>ANY.RUN provides healthcare organizations with proactive tools to analyze and investigate ransomware attacks at various stages.&nbsp;<\/p>\n\n\n\n<p>Let\u2019s discover how by having a look at the Interlock ransomware group. The stages of the attack are taken from one of the most <a href=\"https:\/\/blog.talosintelligence.com\/emerging-interlock-ransomware\/\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">detailed reports<\/a> on the threat from Talos, released on January 14, 2025.&nbsp;<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">1. Initial Compromise (TA0001)&nbsp;<\/h3>\n\n\n\n<p>At this stage, the Interlock ransomware group uses the Drive-by Compromise technique to gain access to the victim\u2019s infrastructure.&nbsp;<\/p>\n\n\n\n<p><strong>Drive-by Compromise: How It Happened<\/strong>&nbsp;<\/p>\n\n\n\n<p>The Interlock ransomware group either compromised or newly registered a phishing website, as evidenced by recent registration data in <a href=\"https:\/\/www.whois.com\/whois\/apple-online.shop\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">Whois<\/a>. This phishing site was designed to appear as a <a href=\"http:\/\/web.archive.org\/web\/20240618134619\/https:\/\/apple-online.shop\/\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">news feed<\/a>, complete with links for downloading software. Unwary users visiting the site were tricked into downloading malicious files.&nbsp;<\/p>\n\n\n\n<p>Here is how ANY.RUN\u2019s <a href=\"https:\/\/any.run\/cybersecurity-blog\/introducing-any-run-threat-intelligence-lookup\/\" target=\"_blank\" rel=\"noreferrer noopener\">Threat Intelligence Lookup<\/a> could be used by analysts at this stage of the attack.&nbsp;<\/p>\n\n\n\n<p><strong>Early Detection of Malicious Domains<\/strong>&nbsp;<\/p>\n\n\n\n<p>By querying the domain <strong>apple-online.shop<\/strong>, ANY.RUN found that users first flagged and analyzed the website on September 6, 2024, almost a month before public mentions of the group appeared in this <a href=\"https:\/\/www.moxfive.com\/resources\/moxfive-threat-actor-spotlight-interlock-ransomware\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">report<\/a>. <\/p>\n\n\n\n<div class=\"wpdt-c row wpDataTableContainerSimpleTable wpDataTables wpDataTablesWrapper\n\"\n    >\n        <table id=\"wpdtSimpleTable-229\"\n           style=\"border-collapse:collapse;\n                   border-spacing:0px;\"\n           class=\"wpdtSimpleTable wpDataTable\"\n           data-column=\"1\"\n           data-rows=\"1\"\n           data-wpID=\"229\"\n           data-responsive=\"0\"\n           data-has-header=\"0\">\n\n                    <tbody>        <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell wpdt-align-left\"\n                                            data-cell-id=\"A1\"\n                    data-col-index=\"0\"\n                    data-row-index=\"0\"\n                    style=\" width:100%;                    padding:10px;\n                    \"\n                    >\n                                        <a class=\"wpdt-link-content\" style=\"color: #009cff; text-decoration: underline\" href=\"https:\/\/intelligence.any.run\/analysis\/lookup\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=interlock_attack&amp;utm_term=280125&amp;utm_content=linktolookup#%7B%2522query%2522:%2522apple-online.shop%2522,%2522dateRange%2522:180%7D\"  rel=\"\" target=\"_blank\" data-cell-id=\"00\" data-link-url=\"https:\/\/intelligence.any.run\/analysis\/lookup\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=interlock_attack&amp;utm_term=280125&amp;utm_content=linktolookup#%7B%2522query%2522:%2522apple-online.shop%2522,%2522dateRange%2522:180%7D\" data-link-text=\"domainName:&quot;apple-online.shop$&quot; \" data-link-target=\"true\" data-link-nofollow=\"0\" data-link-noreferrer=\"0\" data-link-sponsored=\"0\" data-link-btn-status=\"0\" data-link-btn-class=\"\" data-link-content=\"wpdt-link-content\">domainName:&quot;apple-online.shop$&quot; <\/a>                    <\/td>\n                                        <\/tr>\n                    <\/table>\n<\/div><style id='wpdt-custom-style-229'>\ntable#wpdtSimpleTable-229{ table-layout: fixed !important; }\ntable#wpdtSimpleTable-229 td, table.wpdtSimpleTable229 th { white-space: normal !important; }\n<\/style>\n\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"599\" src=\"\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/results_interlock-1-1024x599.png\" alt=\"\" class=\"wp-image-11290\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/results_interlock-1-1024x599.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/results_interlock-1-300x175.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/results_interlock-1-768x449.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/results_interlock-1-1536x898.png 1536w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/results_interlock-1-370x216.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/results_interlock-1-270x158.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/results_interlock-1-740x433.png 740w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/results_interlock-1.png 1842w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><em>TI Lookup provides dozens of sandbox reports featuring the queried malicious domain<\/em><\/figcaption><\/figure><\/div>\n\n\n<p>This means ANY.RUN detected suspicious activity nearly two months before the Talos report was published.&nbsp;<\/p>\n\n\n\n<p>Thanks to ANY.RUN\u2019s access to <a href=\"https:\/\/app.any.run\/submissions\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=interlock_attack&amp;utm_term=280125&amp;utm_content=linktoservice\" target=\"_blank\" rel=\"noreferrer noopener\">public samples<\/a> of the latest cyber threats from around the world, users of TI Lookup were able to identify Interlock\u2019s domain as malicious before public reports. With such early detection, healthcare organizations can take preventative measures long before public alerts are raised.&nbsp;<\/p>\n\n\n\n<!-- Regular Banner START -->\n<div class=\"regular-banner\">\n<!-- Text Content -->\n<p class=\"regular-banner__text\">\nCollect threat intelligence with <span class=\"highlight\">TI Lookup<\/span> to improve your company&#8217;s security&nbsp;   \n<\/p>\n<!-- CTA Link -->\n<a class=\"regular-banner__link\" id=\"article-banner-regular\" href=\"https:\/\/intelligence.any.run\/plans\/?utm_source=anyrunblog&#038;utm_medium=article&#038;utm_campaign=interlock_attack&#038;utm_term=280125&#038;utm_content=linktotiplans\" rel=\"noopener\" target=\"_blank\">\nGet 50 free requests\n<\/a>\n<\/div>\n<!-- Regular Banner END -->\n<!-- Regular Banner Styles START -->\n\n<style>\n.regular-banner {\ndisplay: flex;\ntext-align: center;\nflex-direction: column;\nalign-items: center;\ngap: 1.5rem;\nwidth: 100%;\npadding: 2rem;\nmargin: 1.5rem 0;\nborder-radius: 0.5rem;\nfont-family: 'Catamaran Bold';\nmargin-inline: auto;\nbackground: rgba(32, 168, 241, 0.1);\nborder: 1px solid rgba(75, 174, 227, 0.32);\n}\n\n.regular-banner__text {\nfont-size: 1.5rem;\nmargin: 0;\n}\n\n.highlight {\ncolor: #ea2526;\n}\n\n.regular-banner__link {\npadding: 0.5rem 1.5rem;\nfont-weight: 500;\ntext-decoration: none;\nborder-radius: 0.5rem;\ncolor: #FFFFFF;\nbackground-color: #1491D4;\ntext-align: center;\ntransition: all 0.2s ease-in;\n}\n\n.regular-banner__link:hover {\nbackground-color: #68CBFF;\ncolor: white;\n}\n<\/style>\n<!-- Regular Banner Styles END -->\n\n\n\n<p><strong>Understanding Website Content<\/strong>&nbsp;<\/p>\n\n\n\n<p>With the help of ANY.RUN\u2019s <a href=\"https:\/\/any.run\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=interlock_attack&amp;utm_term=280125&amp;utm_content=linktolanding\" target=\"_blank\" rel=\"noreferrer noopener\">Interactive Sandbox<\/a>, you can view <a href=\"https:\/\/app.any.run\/tasks\/08696be3-e218-427e-a141-b64cf90fb5d2\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=interlock_attack&amp;utm_term=280125&amp;utm_content=linktoservice\" target=\"_blank\" rel=\"noreferrer noopener\">how the malicious website looked like<\/a> and what content was used to deceive users. By analyzing such sites, healthcare organizations can train employees to recognize and avoid similar threats in the future.\u00a0<\/p>\n\n\n\n<p><a href=\"https:\/\/app.any.run\/tasks\/08696be3-e218-427e-a141-b64cf90fb5d2\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=interlock_attack&amp;utm_term=280125&amp;utm_content=linktoservice\" target=\"_blank\" rel=\"noreferrer noopener\">View analysis session<\/a>\u00a0<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"583\" src=\"\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/imaged-1-1024x583.png\" alt=\"\" class=\"wp-image-11256\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/imaged-1-1024x583.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/imaged-1-300x171.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/imaged-1-768x438.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/imaged-1-1536x875.png 1536w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/imaged-1-2048x1167.png 2048w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/imaged-1-370x211.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/imaged-1-270x154.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/imaged-1-740x422.png 740w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><em>The malicious website used by Interlock displayed in ANY.RUN\u2019s sandbox<\/em><\/figcaption><\/figure><\/div>\n\n\n<p>The virtual machine allows anyone to see the behavior of this threat and interact with it in real time.&nbsp;<\/p>\n\n\n\n<p><strong>Expanding on Known Threat Information<\/strong>&nbsp;<\/p>\n\n\n\n<p>ANY.RUN\u2019s data can also enrich users\u2019 existing knowledge of the attack. &nbsp;<\/p>\n\n\n\n<p>While reports stated that the attackers used malware disguised as a Google Chrome updater, ANY.RUN uncovered additional tactics, such as mimicking MSTeams and <a href=\"https:\/\/app.any.run\/tasks\/9699045d-54c7-4dc2-ae4a-0760755418ab\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=interlock_attack&amp;utm_term=280125&amp;utm_content=linktoservice\" target=\"_blank\" rel=\"noreferrer noopener\">MicrosoftEdge updates<\/a> (evident in filenames like MSTeamsSetup.exe and MicrosoftEdgeSetup.exe).\u00a0<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"262\" src=\"\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/imagee-1024x262.png\" alt=\"\" class=\"wp-image-11257\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/imagee-1024x262.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/imagee-300x77.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/imagee-768x196.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/imagee-370x95.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/imagee-270x69.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/imagee-740x189.png 740w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/imagee.png 1534w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><em>ANY.RUN reports with analysis of Interlock\u2019s fake updater programs<\/em><\/figcaption><\/figure><\/div>\n\n\n<p>This shows that by identifying alternative disguises used for malware, ANY.RUN equips organizations to anticipate a broader range of file disguises utilized by Interlock.&nbsp;<\/p>\n\n\n\n<p><strong>IOCs and File Analysis&nbsp;<\/strong><\/p>\n\n\n\n<p>Reports mentioned a specific file named upd_2327991.exe used in the attack. ANY.RUN&#8217;s database reveals additional files with similar naming conventions, such as:&nbsp;<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/app.any.run\/tasks\/28e736e9-a4af-467a-9334-e4c6803af416\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=interlock_attack&amp;utm_term=280125&amp;utm_content=linktoservice\" target=\"_blank\" rel=\"noreferrer noopener\">upd_8816295.exe<\/a>\u00a0<\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/app.any.run\/tasks\/934692bb-a3d5-46c8-884e-bfb7d63d51f9\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=interlock_attack&amp;utm_term=280125&amp;utm_content=linktoservice\" target=\"_blank\" rel=\"noreferrer noopener\">upd_1416836.exe<\/a>\u00a0<\/li>\n<\/ul>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"260\" src=\"\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/image1b-1024x260.png\" alt=\"\" class=\"wp-image-11258\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/image1b-1024x260.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/image1b-300x76.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/image1b-768x195.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/image1b-370x94.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/image1b-270x69.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/image1b-740x188.png 740w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/image1b.png 1064w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><em>Search with ANY.RUN\u2019s TI Lookup reveals additional file names used by Interlock<\/em><\/figcaption><\/figure><\/div>\n\n\n<p>This suggests that the attackers generated file names using random alphanumeric patterns. Each file had distinct hash values (SHA256), which serve as unique <strong>Indicators of Compromise (IOCs):<\/strong>&nbsp;<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>8d911ef72bdb4ec5b99b7548c0c89ffc8639068834a5e2b684c9d78504550927&nbsp;<\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li>97105ed172e5202bc219d99980ebbd01c3dfd7cd5f5ac29ca96c5a09caa8af67&nbsp;<\/li>\n<\/ul>\n\n\n\n<p>The analysis showed that with the help of ANY.RUN\u2019s TI Lookup and Interactive Sandbox, healthcare organizations facing Interlock ransomware attacks could:&nbsp;<\/p>\n\n\n\n<!-- Regular Banner START -->\n<div class=\"regular-banner\">\n<!-- Text Content -->\n<p class=\"regular-banner__text\">\nIntegrate proactive threat analysis with <span class=\"highlight\">ANY.RUN<\/span> <br>to strengthen your company&#8217;s security&nbsp;   \n<\/p>\n<!-- CTA Link -->\n<a class=\"regular-banner__link\" id=\"article-banner-regular\" href=\"https:\/\/any.run\/demo\/?utm_source=anyrunblog&#038;utm_medium=article&#038;utm_campaign=interlock_attack&#038;utm_term=280125&#038;utm_content=linktodemo\" rel=\"noopener\" target=\"_blank\">\nGet 14-day free trial\n<\/a>\n<\/div>\n<!-- Regular Banner END -->\n<!-- Regular Banner Styles START -->\n\n<style>\n.regular-banner {\ndisplay: flex;\ntext-align: center;\nflex-direction: column;\nalign-items: center;\ngap: 1.5rem;\nwidth: 100%;\npadding: 2rem;\nmargin: 1.5rem 0;\nborder-radius: 0.5rem;\nfont-family: 'Catamaran Bold';\nmargin-inline: auto;\nbackground: rgba(32, 168, 241, 0.1);\nborder: 1px solid rgba(75, 174, 227, 0.32);\n}\n\n.regular-banner__text {\nfont-size: 1.5rem;\nmargin: 0;\n}\n\n.highlight {\ncolor: #ea2526;\n}\n\n.regular-banner__link {\npadding: 0.5rem 1.5rem;\nfont-weight: 500;\ntext-decoration: none;\nborder-radius: 0.5rem;\ncolor: #FFFFFF;\nbackground-color: #1491D4;\ntext-align: center;\ntransition: all 0.2s ease-in;\n}\n\n.regular-banner__link:hover {\nbackground-color: #68CBFF;\ncolor: white;\n}\n<\/style>\n<!-- Regular Banner Styles END -->\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Discover the Start Date of Attacks<\/strong>: Get information about the first activities of the attacking group, which often happen before public reports.&nbsp;&nbsp;<\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Study the Attacker&#8217;s Setup<\/strong>: Identify the domains, IP addresses, and other parts of the attacker&#8217;s setup to learn more about their tactics and methods.&nbsp;&nbsp;<\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Improve Detection Systems<\/strong>: Collect additional IOCs to configure defensive mechanisms and improve attack detection.&nbsp;<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">2. TA0002: Execution <\/h3>\n\n\n\n<p>Once attackers gain initial access, the <strong>Execution phase<\/strong> begins. This stage involves deploying malicious payloads or executing harmful commands on the compromised device. In the Interlock ransomware attacks, users unknowingly launch a fake updater file, triggering the execution of malware and allowing attackers to establish control over the victim&#8217;s system.&nbsp;<\/p>\n\n\n\n<p><strong>How Interlock Group Executes Their Attacks<\/strong><\/p>\n\n\n\n<p>The reports revealed that the attackers leveraged Remote Access Tools (RATs), which provided them with full control of the infected machine. By disguising these RATs as legitimate software, such as Chrome, MSTeams, or Microsoft Edge updaters, the attackers ensured that their actions remained unnoticed until significant damage was done.&nbsp;<\/p>\n\n\n\n<p><strong>Detecting Encrypted URLs in Fake Updaters<\/strong><\/p>\n\n\n\n<p>With ANY.RUN Sandbox, analysts could uncover that the fake-updater contained encrypted URLs used to communicate with the attackers&#8217; infrastructure. For example, the xor-url tag in ANY.RUN revealed hidden URLs within the malware\u2019s configuration files.&nbsp;<\/p>\n\n\n\n<p><a href=\"https:\/\/app.any.run\/tasks\/28e736e9-a4af-467a-9334-e4c6803af416\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=interlock_attack&amp;utm_term=280125&amp;utm_content=linktoservice\" target=\"_blank\" rel=\"noreferrer noopener\">View analysis session<\/a>\u00a0<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"824\" height=\"118\" src=\"\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/image1c.png\" alt=\"\" class=\"wp-image-11259\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/image1c.png 824w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/image1c-300x43.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/image1c-768x110.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/image1c-370x53.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/image1c-270x39.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/image1c-740x106.png 740w\" sizes=\"(max-width: 824px) 100vw, 824px\" \/><figcaption class=\"wp-element-caption\"><em>The CFG label indicates that there is a configuration data available for the process<\/em>&nbsp;<\/figcaption><\/figure><\/div>\n\n\n<p>By clicking on the <strong>CFG (Configuration)<\/strong> option in the sandbox, analysts can view decrypted URLs. These insights provide actionable intelligence about the malware\u2019s communication methods and help identify similar patterns in future attacks.&nbsp;<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"578\" height=\"139\" src=\"\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/image1d.png\" alt=\"\" class=\"wp-image-11260\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/image1d.png 578w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/image1d-300x72.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/image1d-370x89.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/image1d-270x65.png 270w\" sizes=\"(max-width: 578px) 100vw, 578px\" \/><figcaption class=\"wp-element-caption\"><em>The URL decrypted by ANY.RUN<\/em>&nbsp;<\/figcaption><\/figure><\/div>\n\n\n<p><strong>Using YARA Search to Find More Samples<\/strong><\/p>\n\n\n\n<p>ANY.RUN\u2019s <strong>YARA Search<\/strong> functionality allowed researchers to create a rule for detecting RAT samples linked to the attack.&nbsp;&nbsp;<\/p>\n\n\n\n<p>Here\u2019s an example of a YARA rule tailored for identifying Interlock\u2019s disguised RAT samples:&nbsp;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>rule Interlock_RAT {  \n\n    strings:  \n\n        $ = \"\/MSTeamsSetup.exe\\\\\" xor  \n\n        $ = \"\/ChromeSetup.exe\\\\\" xor  \n\n        $ = \"\/MicrosoftEdgeSetup.exe\\\\\" xor  \n\n    condition:  \n\n        any of them  \n\n} <\/code><\/pre>\n\n\n\n<p>This YARA rule uncovered over 44 new malicious files, each representing a new indicator. <\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"762\" src=\"\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/image1e-1024x762.png\" alt=\"\" class=\"wp-image-11261\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/image1e-1024x762.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/image1e-300x223.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/image1e-768x572.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/image1e-1536x1144.png 1536w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/image1e-370x275.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/image1e-270x201.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/image1e-740x551.png 740w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/image1e-80x60.png 80w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/image1e.png 1542w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><em>YARA Search in TI Lookup<\/em>&nbsp;<\/figcaption><\/figure><\/div>\n\n\n<p>These IOCs can be added to detection systems, expanding the scope of protection.&nbsp;<\/p>\n\n\n\n<p><strong>Discovering Additional IOCs<\/strong>&nbsp;<\/p>\n\n\n\n<p>In addition to detecting malicious files, <a href=\"https:\/\/app.any.run\/tasks\/30b1804e-b9a6-4ff5-b293-e989aaadba18\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=interlock_attack&amp;utm_term=280125&amp;utm_content=linktoservice\" target=\"_blank\" rel=\"noreferrer noopener\">ANY.RUN\u2019s sandbox session<\/a> revealed network IOCs such as URLs and IP addresses that previously were not covered in other reports.\u00a0<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"988\" height=\"134\" src=\"\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/image1f.png\" alt=\"\" class=\"wp-image-11262\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/image1f.png 988w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/image1f-300x41.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/image1f-768x104.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/image1f-370x50.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/image1f-270x37.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/image1f-740x100.png 740w\" sizes=\"(max-width: 988px) 100vw, 988px\" \/><figcaption class=\"wp-element-caption\"><em>One of the URLs found via TI Lookup and not mentioned in Talos\u2019s report<\/em><\/figcaption><\/figure><\/div>\n\n\n<p>The URL shown above was not included in the detailed report from Talos. &nbsp;<\/p>\n\n\n\n<p>Had the organizations encountering this URL and payload used ANY.RUN\u2019s Interactive Sandbox, they would be able to run the RAT in a safe virtual environment and see its malicious nature. This could have prevented them from detonating the payload on their own systems.&nbsp;<\/p>\n\n\n\n<p>During Execution, ANY.RUN helps users:&nbsp;<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Discover IOCs<\/strong>: Find additional file and network IoCs, including those found in configurations.&nbsp;<\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Find Unknown Threats<\/strong>: Discover previously unknown threats.&nbsp;<\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Analyze Threats<\/strong>: Safely explore suspicious URLs and detonate payloads.&nbsp;<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">3. TA0006: Credential Access&nbsp;<\/h3>\n\n\n\n<p>Once attackers gain the ability to execute commands on a compromised system, their next move often involves stealing access credentials. In the Interlock ransomware attack, the group employed a custom stealer tool to gather and exfiltrate these credentials.&nbsp;<\/p>\n\n\n\n<p><strong>How Credential Stealing Works in This Attack<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>The attackers\u2019 stealer was designed to collect sensitive data, including usernames, passwords, and other access credentials.&nbsp;<\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li>According to vendor reports, the stolen data was stored in a file named \u201cchrgetpdsi.txt.\u201d This file served as a repository for harvested credentials before exfiltration.&nbsp;<\/li>\n<\/ul>\n\n\n\n<p>Let\u2019s use TI Lookup to find more information on the stealer: &nbsp;<\/p>\n\n\n\n<div class=\"wpdt-c row wpDataTableContainerSimpleTable wpDataTables wpDataTablesWrapper\n\"\n    >\n        <table id=\"wpdtSimpleTable-230\"\n           style=\"border-collapse:collapse;\n                   border-spacing:0px;\"\n           class=\"wpdtSimpleTable wpDataTable\"\n           data-column=\"1\"\n           data-rows=\"1\"\n           data-wpID=\"230\"\n           data-responsive=\"0\"\n           data-has-header=\"0\">\n\n                    <tbody>        <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell wpdt-align-left\"\n                                            data-cell-id=\"A1\"\n                    data-col-index=\"0\"\n                    data-row-index=\"0\"\n                    style=\" width:100%;                    padding:10px;\n                    \"\n                    >\n                                        <a class=\"wpdt-link-content\" style=\"color: #009cff; text-decoration: underline\" href=\"https:\/\/intelligence.any.run\/analysis\/lookup\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=interlock_attack&amp;utm_term=280125&amp;utm_content=linktolookup#%7B%2522query%2522:%2522filePath:%255C%2522chrgetpdsi.txt$%255C%2522%2522,%2522dateRange%2522:180%7D\"  rel=\"\" target=\"_blank\" data-cell-id=\"00\" data-link-url=\"https:\/\/intelligence.any.run\/analysis\/lookup\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=interlock_attack&amp;utm_term=280125&amp;utm_content=linktolookup#%7B%2522query%2522:%2522filePath:%255C%2522chrgetpdsi.txt$%255C%2522%2522,%2522dateRange%2522:180%7D\" data-link-text=\"filePath:&quot;chrgetpdsi.txt$&quot;\" data-link-target=\"true\" data-link-nofollow=\"0\" data-link-noreferrer=\"0\" data-link-sponsored=\"0\" data-link-btn-status=\"0\" data-link-btn-class=\"\" data-link-content=\"wpdt-link-content\">filePath:&quot;chrgetpdsi.txt$&quot;<\/a>                    <\/td>\n                                        <\/tr>\n                    <\/table>\n<\/div><style id='wpdt-custom-style-230'>\ntable#wpdtSimpleTable-230{ table-layout: fixed !important; }\ntable#wpdtSimpleTable-230 td, table.wpdtSimpleTable230 th { white-space: normal !important; }\n<\/style>\n\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"612\" src=\"\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/image20-1024x612.png\" alt=\"\" class=\"wp-image-11263\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/image20-1024x612.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/image20-300x179.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/image20-768x459.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/image20-1536x918.png 1536w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/image20-2048x1223.png 2048w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/image20-370x221.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/image20-270x161.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/image20-740x442.png 740w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><em>Results of a TI Lookup search for a txt file used in the attack<\/em><\/figcaption><\/figure><\/div>\n\n\n<p>As a result, we see that the Stealer had been detected by ANY.RUN as early as August 2024, well before users began investigating the compromised domain.&nbsp;<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"91\" src=\"\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/image21-1024x91.png\" alt=\"\" class=\"wp-image-11265\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/image21-1024x91.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/image21-300x27.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/image21-768x69.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/image21-370x33.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/image21-270x24.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/image21-1500x135.png 1500w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/image21-740x66.png 740w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/image21.png 1511w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><em>The first sandbox report on the stealer used by Interlock<\/em>&nbsp;<\/figcaption><\/figure><\/div>\n\n\n<p>Early detection of malicious tools like this Stealer provides security teams with actionable intelligence to defend against evolving threats.&nbsp;<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">4. TA0008: Lateral Movement&nbsp;<\/h3>\n\n\n\n<p>At the Lateral Movement phase, attackers aim to spread across the network, gaining access to additional systems and resources. &nbsp;<\/p>\n\n\n\n<p>The Interlock ransomware group moved laterally within networks using legitimate remote administration tools like Putty, Anydesk, and RDP. These tools are often abused by attackers to access additional systems undetected.&nbsp;<\/p>\n\n\n\n<div class=\"wpdt-c row wpDataTableContainerSimpleTable wpDataTables wpDataTablesWrapper\n\"\n    >\n        <table id=\"wpdtSimpleTable-231\"\n           style=\"border-collapse:collapse;\n                   border-spacing:0px;\"\n           class=\"wpdtSimpleTable wpDataTable\"\n           data-column=\"2\"\n           data-rows=\"4\"\n           data-wpID=\"231\"\n           data-responsive=\"0\"\n           data-has-header=\"1\">\n\n                    <thead>        <tr class=\"wpdt-cell-row \" >\n                                <th class=\"wpdt-cell wpdt-align-center wpdt-merged-cell \"\n                     colspan=\"2\"  rowspan=\"1\"                     data-cell-id=\"A1\"\n                    data-col-index=\"0\"\n                    data-row-index=\"0\"\n                    style=\" width:100%;                    padding:10px;\n                    \"\n                    >\n                                        TI Lookup Queries\u00a0                    <\/th>\n                                                    <\/tr>\n                    <tbody>        <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell wpdt-align-left\"\n                                            data-cell-id=\"A2\"\n                    data-col-index=\"0\"\n                    data-row-index=\"1\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Putty\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell wpdt-align-left\"\n                                            data-cell-id=\"B2\"\n                    data-col-index=\"1\"\n                    data-row-index=\"1\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        <a class=\"wpdt-link-content\" style=\"color: #009cff; text-decoration: underline\" href=\"https:\/\/intelligence.any.run\/analysis\/lookup\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=interlock_attack&amp;utm_term=280125&amp;utm_content=linktolookup#%7B%2522query%2522:%2522threatName:%255C%2522putty%255C%2522%2522,%2522dateRange%2522:180%7D\"  rel=\"\" target=\"_blank\" data-cell-id=\"11\" data-link-url=\"https:\/\/intelligence.any.run\/analysis\/lookup\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=interlock_attack&amp;utm_term=280125&amp;utm_content=linktolookup#%7B%2522query%2522:%2522threatName:%255C%2522putty%255C%2522%2522,%2522dateRange%2522:180%7D\" data-link-text=\"threatName:&quot;putty&quot;\" data-link-target=\"true\" data-link-nofollow=\"0\" data-link-noreferrer=\"0\" data-link-sponsored=\"0\" data-link-btn-status=\"0\" data-link-btn-class=\"\" data-link-content=\"wpdt-link-content\">threatName:&quot;putty&quot;<\/a>                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell wpdt-align-left\"\n                                            data-cell-id=\"A3\"\n                    data-col-index=\"0\"\n                    data-row-index=\"2\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Anydesk\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell wpdt-align-left\"\n                                            data-cell-id=\"B3\"\n                    data-col-index=\"1\"\n                    data-row-index=\"2\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        <a class=\"wpdt-link-content\" style=\"color: #009cff; text-decoration: underline\" href=\"https:\/\/intelligence.any.run\/analysis\/lookup\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=interlock_attack&amp;utm_term=280125&amp;utm_content=linktolookup#%7B%2522query%2522:%2522threatName:%255C%2522anydesk%255C%2522%2522,%2522dateRange%2522:180%7D\"  rel=\"\" target=\"_blank\" data-cell-id=\"21\" data-link-url=\"https:\/\/intelligence.any.run\/analysis\/lookup\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=interlock_attack&amp;utm_term=280125&amp;utm_content=linktolookup#%7B%2522query%2522:%2522threatName:%255C%2522anydesk%255C%2522%2522,%2522dateRange%2522:180%7D\" data-link-text=\"threatName:&quot;anydesk&quot;\" data-link-target=\"true\" data-link-nofollow=\"0\" data-link-noreferrer=\"0\" data-link-sponsored=\"0\" data-link-btn-status=\"0\" data-link-btn-class=\"\" data-link-content=\"wpdt-link-content\">threatName:&quot;anydesk&quot;<\/a>                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell wpdt-align-left\"\n                                            data-cell-id=\"A4\"\n                    data-col-index=\"0\"\n                    data-row-index=\"3\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        RDP\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell wpdt-align-left\"\n                                            data-cell-id=\"B4\"\n                    data-col-index=\"1\"\n                    data-row-index=\"3\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        <a class=\"wpdt-link-content\" style=\"color: #009cff; text-decoration: underline\" href=\"https:\/\/intelligence.any.run\/analysis\/lookup\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=interlock_attack&amp;utm_term=280125&amp;utm_content=linktolookup#%7B%2522query%2522:%2522threatName:%255C%2522rdp%255C%2522%2522,%2522dateRange%2522:180%7D\"  rel=\"\" target=\"_blank\" data-cell-id=\"31\" data-link-url=\"https:\/\/intelligence.any.run\/analysis\/lookup\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=interlock_attack&amp;utm_term=280125&amp;utm_content=linktolookup#%7B%2522query%2522:%2522threatName:%255C%2522rdp%255C%2522%2522,%2522dateRange%2522:180%7D\" data-link-text=\"threatName:&quot;rdp&quot;\" data-link-target=\"true\" data-link-nofollow=\"0\" data-link-noreferrer=\"0\" data-link-sponsored=\"0\" data-link-btn-status=\"0\" data-link-btn-class=\"\" data-link-content=\"wpdt-link-content\">threatName:&quot;rdp&quot;<\/a>                    <\/td>\n                                        <\/tr>\n                    <\/table>\n<\/div><style id='wpdt-custom-style-231'>\ntable#wpdtSimpleTable-231{ table-layout: fixed !important; }\ntable#wpdtSimpleTable-231 td, table.wpdtSimpleTable231 th { white-space: normal !important; }\n<\/style>\n\n\n\n\n<p>The ANY.RUN Sandbox excels at identifying the presence of these tools when they are abused for malicious purposes. <\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"615\" src=\"\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/image22-1024x615.png\" alt=\"\" class=\"wp-image-11267\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/image22-1024x615.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/image22-300x180.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/image22-768x461.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/image22-1536x922.png 1536w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/image22-2048x1230.png 2048w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/image22-370x222.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/image22-270x162.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/image22-740x444.png 740w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><em>Signature in ANY.RUN\u2019s Interactive Sandbox indicating the presence of Putty<\/em><\/figcaption><\/figure><\/div>\n\n\n<p>By executing suspicious files in a controlled environment, ANY.RUN can:&nbsp;<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Detect the execution of <strong>Putty, Anydesk,<\/strong> or <strong>RDP-related activities.<\/strong>&nbsp;<\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Provide detailed insights into how these tools are being used by attackers.&nbsp;<\/li>\n<\/ul>\n\n\n\n<!-- CTA Split START -->\n<div class=\"cta-split\">\n<div class=\"cta__split-left\">\n\n<!-- Image -->\n<img decoding=\"async\" loading=\"lazy\" src=\"https:\/\/mcusercontent.com\/663b94f19348582a8dc323efe\/images\/0d88188b-3e89-2314-5a60-cb87e8077326.png\" alt=\"ANY.RUN cloud interactive sandbox interface\" class=\"cta__split-icon\" \/>\n<\/div>\n\n<div class=\"cta__split-right\">\n<div>\n\n<!-- Heading -->\n<h3 class=\"cta__split-heading\"><br>Sandbox for Business<\/h3>\n\n<!-- Text -->\n<p class=\"cta__split-text\">\nDiscover all features of the <span class=\"highlight\">Enterprise plan<\/span> designed for businesses and large security teams.\n<br \/>\n<\/p>\n<\/div>\n<!-- CTA Link -->\n<a target=\"_blank\" rel=\"noopener\" id=\"article-banner-split\" href=\"https:\/\/any.run\/cybersecurity-blog\/anyrun-for-enterprises\/\"><div class=\"cta__split-link\">See details<\/div><\/a>\n<\/div>\n<\/div>\n<!-- CTA Split END -->\n<!-- CTA Split Styles START -->\n<style>\n.cta-split {\noverflow: hidden;\nmargin: 3rem 0;\ndisplay: grid;\njustify-items: center;\nborder-radius: 0.5rem;\nwidth: 100%;\nmin-height: 25rem;\ngrid-template-columns: repeat(2, 1fr);\nborder: 1px solid rgba(75, 174, 227, 0.32);\nfont-family: 'Catamaran Bold';\n}\n\n.cta__split-left {\ndisplay: flex;\nalign-items: center;\njustify-content: center;\nheight: 100%;\nwidth: 100%;\nbackground-color: #161c59;\nbackground-position: center center;\nbackground: rgba(32, 168, 241, 0.1);\n}\n\n.cta__split-icon { \nwidth: 100%;\nheight: auto;\nobject-fit: contain;\nmax-width: 100%;\n}\n\n.cta__split-right {\ndisplay: flex;\nflex-direction: column;\njustify-content: space-between;\npadding: 2rem;\n}\n\n.cta__split-heading { font-size: 1.5rem; }\n\n.cta__split-text {\nmargin-top: 1rem;\nfont-family: Lato, Roboto, sans-serif;\n}\n\n.cta__split-link {\npadding: 0.5rem 1rem;\nfont-weight: 500;\ntext-decoration: none;\nborder-radius: 0.5rem;\ncolor: white;\nbackground-color: #1491D4;\ntext-align: center;\ntransition: all 0.2s ease-in;\ndisplay: block;\nz-index: 1000;\nposition: relative;\ncursor: pointer !important;\n}\n\n.cta__split-link:hover {\nbackground-color: #68CBFF;\ncolor: white;\ncursor: pointer;\n}\n\n.highlight { color: #ea2526;}\n\n\n\/* Mobile styles START *\/\n@media only screen and (max-width: 768px) {\n\n.cta-split {\ngrid-template-columns: 1fr;\nmin-height: auto;\n}\n\n.cta__split-left {\nheight: auto;\nmin-height: 10rem;\n}\n\n\n.cta__split-left, .cta__split-right {\nheight: auto;\n}\n\n.cta__split-heading { font-size: 1.2rem; }\n\n.cta__split-text { font-size: 1rem; }\n.cta__split-icon {\nmax-height: auto;\nobject-fit: cover;\n}\n\n}\n\/* Mobile styles END *\/\n<\/style>\n<!-- CTA Split Styles END -->\n\n\n\n<h3 class=\"wp-block-heading\">5. TA0010: Data Exfiltration&nbsp;<\/h3>\n\n\n\n<p>In the Data Exfiltration phase, attackers transfer stolen data out of the victim&#8217;s network. The Interlock ransomware group used Azure cloud storage to exfiltrate data.&nbsp;<\/p>\n\n\n\n<p>Inside the ANY.RUN sandbox, you can see the system configuration data being sent to a Command and Control (C2) server via the RAT.&nbsp;<\/p>\n\n\n\n<p>ANY.RUN captures data sent by the RAT to attacker-controlled servers. <a href=\"https:\/\/app.any.run\/tasks\/155aa0be-6977-4c6a-86c9-24d4c2acf525\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=interlock_attack&amp;utm_term=280125&amp;utm_content=linktoservice\" target=\"_blank\" rel=\"noreferrer noopener\">For this example<\/a>, logs revealed information sent to <strong>IP 217[.]148[.]142[.]19<\/strong> over port <strong>443:<\/strong>\u00a0<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"350\" src=\"\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/image23-1024x350.png\" alt=\"\" class=\"wp-image-11268\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/image23-1024x350.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/image23-300x103.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/image23-768x263.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/image23-370x126.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/image23-270x92.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/image23-740x253.png 740w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/image23.png 1492w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><em>Network traffic of the RAT captured by ANY.RUN\u2019s Interactive Sandbox<\/em><\/figcaption><\/figure><\/div>\n\n\n<p>Using tools like CyberChef, we can decrypt the logged traffic (e.g., XOR-encrypted data) to identify what attackers exfiltrated.&nbsp;<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"302\" src=\"\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/image24-1024x302.png\" alt=\"\" class=\"wp-image-11269\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/image24-1024x302.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/image24-300x89.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/image24-768x227.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/image24-1536x453.png 1536w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/image24-370x109.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/image24-270x80.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/image24-740x218.png 740w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/image24.png 1600w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><em>Decryption with CyberChef shows that the RAT sent system data to attackers<\/em><\/figcaption><\/figure><\/div>\n\n\n<p>Thus, during the Data Exfiltration phase, ANY.RUN Sandbox logs traffic sent to external systems, allowing analysts to identify exactly what data is being transmitted to the attacker\u2019s server.&nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">ANY.RUN\u2019s Key Benefits for Healthcare Organizations<\/h2>\n\n\n\n<p>ANY.RUN empowers healthcare organizations with fast, safe, and effective tools to investigate and analyze cyber threats:&nbsp;<\/p>\n\n\n\n<ul start=\"2\" class=\"wp-block-list\">\n<li><strong>Pin malicious indicators to actual threats<\/strong> to gain a better understanding of the risks your organization is facing.&nbsp;&nbsp;<\/li>\n\n\n\n<li><strong>Receive in-depth reports<\/strong> with IOCs, TTPs, and malware behavior summaries.&nbsp;<\/li>\n\n\n\n<li><strong>Simplify and speed up threat analysis<\/strong>&nbsp;for SOC team members at all levels, saving time and increasing productivity.<\/li>\n\n\n\n<li><strong>Accelerate the alert triage&nbsp;<\/strong>process and reduce the workload through fast operation speeds, a user-friendly interface, and smart automation.<\/li>\n\n\n\n<li><strong>Safely examine sensitive data&nbsp;<\/strong>in a private mode, ensuring compliance with cybersecurity and data protection requirements.<\/li>\n\n\n\n<li><strong>Gain access to detailed insights into malware\u2019s behavior&nbsp;<\/strong>and better understand threats to streamline incident response.<\/li>\n\n\n\n<li><strong>Collaborate with team members<\/strong>, share results, and coordinate efforts efficiently during incident handling.<\/li>\n\n\n\n<li><strong>Optimize the cost of responding to incidents<\/strong>&nbsp;by accessing detailed data with ANY.RUN\u2019s interactive analysis, which helps in developing new detection and protection methods.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Conclusion&nbsp;<\/h2>\n\n\n\n<p>ANY.RUN can be an invaluable tool at various stages of ransomware attacks. During incident investigations, TI Lookup can provide critical data on the threat at hand. Running malware in the ANY.RUN Sandbox before executing it on a local machine allows for a proactive identification of the threat and thorough analysis of its behavior. <\/p>\n\n\n\n<p>By combining ANY.RUN&#8217;s tools, healthcare organizations can not only enhance the understanding of the threats&#8217; capabilities but also ensure that they are identified and mitigated effectively.&nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">About ANY.RUN<\/h2>\n\n\n\n<p><a href=\"https:\/\/any.run\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=interlock_attack&amp;utm_term=280125&amp;utm_content=linktolanding\" target=\"_blank\" rel=\"noreferrer noopener\">ANY.RUN<\/a> helps more than 500,000 cybersecurity professionals worldwide. Our interactive sandbox simplifies malware analysis of threats that target both Windows and Linux systems. Our threat intelligence products, <a href=\"https:\/\/any.run\/cybersecurity-blog\/introducing-any-run-threat-intelligence-lookup\/\" target=\"_blank\" rel=\"noreferrer noopener\">TI Lookup<\/a>, <a href=\"https:\/\/any.run\/cybersecurity-blog\/yara-search\/\" target=\"_blank\" rel=\"noreferrer noopener\">YARA Search<\/a>, and <a href=\"https:\/\/any.run\/cybersecurity-blog\/threat-intelligence-feeds\/\" target=\"_blank\" rel=\"noreferrer noopener\">Feeds<\/a>, help you find IOCs or files to learn more about the threats and respond to incidents faster.<\/p>\n\n\n\n<p><a href=\"https:\/\/any.run\/demo\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=interlock_attack&amp;utm_term=280125&amp;utm_content=linktodemo\" target=\"_blank\" rel=\"noreferrer noopener\">Request free trial of ANY.RUN&#8217;s services \u2192<\/a>&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Ransomware attacks have become a relentless threat to the healthcare sector, exposing sensitive patient data, disrupting life-saving treatments, and placing lives at risk. With healthcare systems underfunded and critical infrastructure vulnerable, cybercriminals find this sector an easy and lucrative target.&nbsp; In recent years, ransomware attacks have not only caused financial losses but have also shaken [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":11247,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8],"tags":[57,10,34,40],"class_list":["post-11244","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-malware-analysis","tag-anyrun","tag-cybersecurity","tag-malware-analysis","tag-malware-behavior"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v20.10 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Analysis of Interlock Ransomware Attack on Healthcare Facilities<\/title>\n<meta name=\"description\" content=\"Discover comprehensive analysis of the attacks of Interlock Ransomware on Healthcare organizations in the United States.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/any.run\/cybersecurity-blog\/interlock-ransomware-attack-analysis\/\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Electron and 4OURUP\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"13 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/any.run\/cybersecurity-blog\/interlock-ransomware-attack-analysis\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/any.run\/cybersecurity-blog\/interlock-ransomware-attack-analysis\/\"},\"author\":{\"name\":\"Electron and 4OURUP\",\"@id\":\"https:\/\/any.run\/\"},\"headline\":\"Interlock Ransomware: Analysis of Attacks on US Healthcare Providers\",\"datePublished\":\"2025-01-28T11:11:13+00:00\",\"dateModified\":\"2025-02-03T13:13:13+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/any.run\/cybersecurity-blog\/interlock-ransomware-attack-analysis\/\"},\"wordCount\":2300,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/any.run\/\"},\"keywords\":[\"ANYRUN\",\"cybersecurity\",\"malware analysis\",\"malware behavior\"],\"articleSection\":[\"Malware Analysis\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/any.run\/cybersecurity-blog\/interlock-ransomware-attack-analysis\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/any.run\/cybersecurity-blog\/interlock-ransomware-attack-analysis\/\",\"url\":\"https:\/\/any.run\/cybersecurity-blog\/interlock-ransomware-attack-analysis\/\",\"name\":\"Analysis of Interlock Ransomware Attack on Healthcare Facilities\",\"isPartOf\":{\"@id\":\"https:\/\/any.run\/\"},\"datePublished\":\"2025-01-28T11:11:13+00:00\",\"dateModified\":\"2025-02-03T13:13:13+00:00\",\"description\":\"Discover comprehensive analysis of the attacks of Interlock Ransomware on Healthcare organizations in the United States.\",\"breadcrumb\":{\"@id\":\"https:\/\/any.run\/cybersecurity-blog\/interlock-ransomware-attack-analysis\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/any.run\/cybersecurity-blog\/interlock-ransomware-attack-analysis\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/any.run\/cybersecurity-blog\/interlock-ransomware-attack-analysis\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/any.run\/cybersecurity-blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Malware Analysis\",\"item\":\"https:\/\/any.run\/cybersecurity-blog\/category\/malware-analysis\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Interlock Ransomware: Analysis of Attacks on US Healthcare Providers\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/any.run\/\",\"url\":\"https:\/\/any.run\/\",\"name\":\"ANY.RUN&#039;s Cybersecurity Blog\",\"description\":\"Cybersecurity Blog covers topics for experienced professionals as well as for those new to it.\",\"publisher\":{\"@id\":\"https:\/\/any.run\/\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/any.run\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/any.run\/\",\"name\":\"ANY.RUN\",\"url\":\"https:\/\/any.run\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/any.run\/\",\"url\":\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2020\/08\/ANYRUN-Icon.svg\",\"contentUrl\":\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2020\/08\/ANYRUN-Icon.svg\",\"width\":1,\"height\":1,\"caption\":\"ANY.RUN\"},\"image\":{\"@id\":\"https:\/\/any.run\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/www.any.run\/\",\"https:\/\/twitter.com\/anyrun_app\",\"https:\/\/www.linkedin.com\/company\/30692044\",\"https:\/\/www.youtube.com\/channel\/UCOgCPho7lzmH7m6fPNlukrQ\"]},[{\"@type\":[\"Person\"],\"@id\":\"https:\/\/any.run\/\",\"name\":\"Electron\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\/\/any.run\/\",\"inLanguage\":\"en_US\",\"url\":\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/05\/6394744-150x150.png\",\"caption\":\"Electron\"}},{\"@type\":[\"Person\"],\"@id\":\"https:\/\/any.run\/\",\"name\":\"4OURUP\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\/\/any.run\/\",\"inLanguage\":\"en_US\",\"url\":\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/4up-150x150.jpg\",\"caption\":\"4OURUP\"}}]]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Analysis of Interlock Ransomware Attack on Healthcare Facilities","description":"Discover comprehensive analysis of the attacks of Interlock Ransomware on Healthcare organizations in the United States.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/any.run\/cybersecurity-blog\/interlock-ransomware-attack-analysis\/","twitter_misc":{"Written by":"Electron and 4OURUP","Est. reading time":"13 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/any.run\/cybersecurity-blog\/interlock-ransomware-attack-analysis\/#article","isPartOf":{"@id":"https:\/\/any.run\/cybersecurity-blog\/interlock-ransomware-attack-analysis\/"},"author":{"name":"Electron and 4OURUP","@id":"https:\/\/any.run\/"},"headline":"Interlock Ransomware: Analysis of Attacks on US Healthcare Providers","datePublished":"2025-01-28T11:11:13+00:00","dateModified":"2025-02-03T13:13:13+00:00","mainEntityOfPage":{"@id":"https:\/\/any.run\/cybersecurity-blog\/interlock-ransomware-attack-analysis\/"},"wordCount":2300,"commentCount":0,"publisher":{"@id":"https:\/\/any.run\/"},"keywords":["ANYRUN","cybersecurity","malware analysis","malware behavior"],"articleSection":["Malware Analysis"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/any.run\/cybersecurity-blog\/interlock-ransomware-attack-analysis\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/any.run\/cybersecurity-blog\/interlock-ransomware-attack-analysis\/","url":"https:\/\/any.run\/cybersecurity-blog\/interlock-ransomware-attack-analysis\/","name":"Analysis of Interlock Ransomware Attack on Healthcare Facilities","isPartOf":{"@id":"https:\/\/any.run\/"},"datePublished":"2025-01-28T11:11:13+00:00","dateModified":"2025-02-03T13:13:13+00:00","description":"Discover comprehensive analysis of the attacks of Interlock Ransomware on Healthcare organizations in the United States.","breadcrumb":{"@id":"https:\/\/any.run\/cybersecurity-blog\/interlock-ransomware-attack-analysis\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/any.run\/cybersecurity-blog\/interlock-ransomware-attack-analysis\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/any.run\/cybersecurity-blog\/interlock-ransomware-attack-analysis\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/any.run\/cybersecurity-blog\/"},{"@type":"ListItem","position":2,"name":"Malware Analysis","item":"https:\/\/any.run\/cybersecurity-blog\/category\/malware-analysis\/"},{"@type":"ListItem","position":3,"name":"Interlock Ransomware: Analysis of Attacks on US Healthcare Providers"}]},{"@type":"WebSite","@id":"https:\/\/any.run\/","url":"https:\/\/any.run\/","name":"ANY.RUN&#039;s Cybersecurity Blog","description":"Cybersecurity Blog covers topics for experienced professionals as well as for those new to it.","publisher":{"@id":"https:\/\/any.run\/"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/any.run\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/any.run\/","name":"ANY.RUN","url":"https:\/\/any.run\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/any.run\/","url":"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2020\/08\/ANYRUN-Icon.svg","contentUrl":"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2020\/08\/ANYRUN-Icon.svg","width":1,"height":1,"caption":"ANY.RUN"},"image":{"@id":"https:\/\/any.run\/"},"sameAs":["https:\/\/www.facebook.com\/www.any.run\/","https:\/\/twitter.com\/anyrun_app","https:\/\/www.linkedin.com\/company\/30692044","https:\/\/www.youtube.com\/channel\/UCOgCPho7lzmH7m6fPNlukrQ"]},[{"@type":["Person"],"@id":"https:\/\/any.run\/","name":"Electron","image":{"@type":"ImageObject","@id":"https:\/\/any.run\/","inLanguage":"en_US","url":"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/05\/6394744-150x150.png","caption":"Electron"}},{"@type":["Person"],"@id":"https:\/\/any.run\/","name":"4OURUP","image":{"@type":"ImageObject","@id":"https:\/\/any.run\/","inLanguage":"en_US","url":"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/01\/4up-150x150.jpg","caption":"4OURUP"}}]]}},"_links":{"self":[{"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/posts\/11244"}],"collection":[{"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/comments?post=11244"}],"version-history":[{"count":35,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/posts\/11244\/revisions"}],"predecessor-version":[{"id":11427,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/posts\/11244\/revisions\/11427"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/media\/11247"}],"wp:attachment":[{"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/media?parent=11244"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/categories?post=11244"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/tags?post=11244"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}