Do Son 
At a Glance
| Attribute | Detail |
|---|---|
| Malware family | Interlock ransomware (double extortion) |
| Threat actor | Interlock, tracked by Sophos as GOLD EMBRACE (confirmed) |
| Target / victims | Critical infrastructure, healthcare, and education in North America and Europe |
| Delivery vector | ClickFix social engineering via a compromised website |
| Key capabilities | Memory-based credential theft, Kerberoasting, persistence, data exfiltration |
| Source | Sophos Emergency Incident Response and Counter Threat Unit |
TL;DR
The Interlock ransomware gang abused Volatility3, a legitimate memory forensics tool, to steal credentials. Sophos investigated the March 2026 intrusion and traced the full attack chain. The case shows how attackers turn defender tools against victims.
Why This Interlock Ransomware Case Matters
Interlock emerged in September 2024 and runs double extortion. It steals data first, then encrypts systems. Next, it threatens to leak files on its “Worldwide Secrets Blog” if victims refuse to pay.
Unlike many crews, Interlock is not Ransomware-as-a-Service. Sophos describes it as “the handiwork of a small, dedicated team of operators that develops its own malware and conducts its own attacks.”
Living Off Legitimate Tools
The standout tactic here is tool abuse. On the first compromised machine, the attacker ran Volatility3 to dump password hashes from a memory image. This pulled NTLM and legacy LM hashes plus account details.
The gang also ran a Volatility3 module to extract cached domain credentials. To capture memory in the first place, it used WinPmem, a genuine acquisition tool from Velocidex. Notably, the customer “knew of no legitimate Volatility3 use on their system.”
The Attack Chain
Initial Access
The intrusion began with a drive-by ClickFix lure. A user searched for Dynamics 365 software and reached a trusted but compromised site. Within seconds, the page read the clipboard through an API call.
The attacker then tricked the user into pasting a command into the Run dialog. That command quietly fetched PowerShell code and installed a remote-access trojan at startup.
Escalation and Movement
The operators paused for a full day, then returned with a plan. They ran LDAP queries to map the domain. Afterward, they escalated privileges through process injection and a Kerberoasting attack.
About 26 hours after initial access, they reached the domain controller. According to Sophos, the actor “moved laterally from the end-user device to a domain controller, leveraging anonymous login to perform a downgrade attack using NTLM.”
Persistence and Data Theft
Interlock buried persistence inside a scheduled task disguised as a routine defrag job. That task ran a payload through node.exe, matching the gang’s known NodeSnake tradecraft.
From there, the attack widened. Sophos found credential dumping, including AWS keys, and new rogue domain-admin accounts. The operators tampered with Defender on unprotected endpoints. In the end, they stole data and locked the victim out of its hypervisors.
Attribution
Attribution here is confirmed, not suspected. Sophos directly attributes the intrusion to Interlock, which its Counter Threat Unit tracks as GOLD EMBRACE. The group also recently exploited a Cisco Secure Firewall zero-day, CVE-2026-20131.
Defense and Detection Guidance
Ensure every endpoint runs active protection. In this case, some endpoints ran none at all. Additionally, treat memory forensics tools as high-risk when they appear without a sanctioned investigation.
Train users against ClickFix lures that ask them to paste commands. Watch for clipboard reads, odd Run-dialog activity, and scheduled tasks mimicking system jobs. Finally, monitor for NTLM downgrade attempts and Kerberoasting against Active Directory.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
