Nation-State critical No formal nation-state attribution; core operators' activity patterns are consistent with a UTC+3 timezone.

Interlock

Independent, closed-group ransomware/extortion operation — not a public RaaS program and not formally attributed to a nation-state. Arctic Wolf tracks the group under the alias Nefarious Mantis. · Financial — double-extortion ransomware (data theft plus encryption, with public shaming via a leak site).

Reports 1

Active Since Late September 2024

Last Reported 29 Jul 2026

Sectors Targeted healthcare, education, manufacturing, government, critical-infrastructure

Tactics, Techniques & Procedures (TTPs)

ClickFix social engineering: fake CAPTCHA/browser-error pages trick victims into pasting a Base64-encoded PowerShell command into the Windows Run dialog
Drive-by downloads disguised as fake Chrome/Edge browser updates
Exploitation of CVE-2026-20131, a CVSS 10.0 unauthenticated RCE (insecure Java deserialization, CWE-502) in Cisco Secure Firepower Management Center, used as a zero-day from 26 Jan 2026 (36 days before Cisco's 4 Mar 2026 disclosure)
NodeSnake RAT (Node.js) for first-stage persistence, using Cloudflare Tunnel subdomains for C2
Interlock RAT second-stage backdoor (code overlap with NodeSnake) plus a PHP-based RAT variant
LummaStealer and BerserkStealer infostealers for credential/session-token harvesting pre-lateral movement
Windows and Linux encryptors, with the Linux variant targeting VMware ESXi hypervisor storage
Double extortion via the Tor-hosted 'Worldwide Secrets Blog' leak site

Known Targets

Healthcare, education, manufacturing, government, and critical infrastructure sectorsTexas Tech University Health Sciences Center (breach Sept 2024; ~1.46M individuals notified)DaVita (dialysis provider, breached April 2025)Kettering Health (Ohio health system, attacked May 2025; ~1.7M individuals notified)AMTEC Corporation / National Defense Corporation (US defense industrial base, disclosed March 2026)

Analyst Notes

Operates as a closed, internally-tooled group rather than an affiliate-based RaaS. Subject of a joint CISA/FBI/HHS/MS-ISAC advisory (AA25-203A, July 2025). The Cisco FMC zero-day marks a notable escalation from social-engineering-only initial access to exploitation of unpatched network security infrastructure.

Also Known As

Nefarious Mantis

MITRE ATT&CK Techniques

T1190 Exploit Public-Facing Application T1204 User Execution T1486 Data Encrypted for Impact T1555.003 Credentials from Web Browsers

Intelligence Reports

Analysis healthcareeducation

Interlock Ransomware: The Closed-Group Operation Running a Zero-Day Healthcare Assault

Interlock emerged in September 2024 and within eighteen months had breached healthcare networks, universities, and defence contractors using ClickFix social engineering, custom RATs, and a CVSS 10.0 Cisco FMC zero-day exploited 36 days before public disclosure.

29 Jul 2026 · 11 min read