CTI & OSINT

The Interlock Ransomware and the Joint Cybersecurity Advisory of July 22, 2025

by  • 

I am revisiting the advisory published on July 22, 2025, in which several U.S. and North American government agencies issued a joint cybersecurity advisory regarding the Interlock ransomware, specifically targeting businesses and critical infrastructure across North America and Europe.

This advisory stems from recent investigations conducted by the Federal Bureau of Investigation (FBI), the Cybersecurity and Infrastructure Security Agency (CISA), the Department of Health and Human Services (HHS), and the Multi-State Information Sharing and Analysis Center (MS-ISAC).

In this neutral analysis, I summarize the key findings and recommendations of the advisory, with the goal of guiding cybersecurity professionals on concrete and immediate actions to defend against the Interlock threat.

Context: A Persistent Threat to Critical Infrastructure

Interlock is among the most active ransomware families observed in 2025. The advisory highlights findings from the FBI, including Indicators of Compromise (IOCs) and common Tactics, Techniques, and Procedures (TTPs) used by Interlock operators. This publication is part of the ongoing #StopRansomware advisory series, which aims to regularly inform network defenders of known ransomware variants.

Targeted sectors include healthcare organizations, public services, essential service providers, as well as technology SMEs with exposed or poorly segmented systems.

Initial Access Vectors: Social Engineering and Known Vulnerabilities

According to the advisory, initial access is typically obtained through two primary methods:

  • Spear-phishing emails, using credible pretexts to trick victims into opening malicious attachments or clicking on infected links.
  • Exploitation of unpatched vulnerabilities in exposed systems or software (VPNs, web services, etc.).

Once inside, the adversary leverages standardized or publicly available tools for lateral movement (e.g., PsExec, RDP, SMB), and then deploys the Interlock encryptor network-wide after gaining elevated privileges.

Key Recommendations for Immediate Protection

1. Blocking Initial Access

It is strongly recommended to implement:

  • DNS filtering applications to block resolutions to known or newly registered malicious domains.
  • Outbound web traffic filtering firewalls, to prevent unauthorized communications.
  • Regular phishing awareness training for employees to recognize social engineering attempts.

2. Proactive Vulnerability Management

Organizations must maintain all operating systems, firmware, third-party software, and network-exposed components (including VPNs and remote access tools) fully updated. The patch management strategy should be closely tied to the SOC and aligned with weekly security bulletins.

3. Network Segmentation and Lateral Movement Limitation

Networks should be segmented based on system usage and sensitivity. Access between segments must be strictly controlled, ideally denied by default. Use isolated VLANs for critical or industrial systems (OT) wherever possible.

4. Identity Management and Universal MFA Enforcement

All user and administrator accounts should be managed under a centralized strong identity policy, including:

  • Removal of inactive or generic accounts.
  • Activation of multi-factor authentication (MFA) on all critical services (VPN, email, remote access).
  • Implementation of role-based access control (RBAC) to prevent unjustified privilege escalation.

Critical Sector Implications

In the healthcare sector, ransomware-induced service interruptions can have direct impacts on patient care. Many facilities still run outdated or unsegmented systems, facilitating malware propagation. The same risk applies to energy grid operators, transport systems, and water/sanitation services.

Toward Collective Defense: The Role of Information Sharing

The advisory strongly encourages victim or targeted entities to share technical data (IOCs, timestamps, artifacts) with their sectoral or regional sharing centers (ISACs/ISAOs, national CERTs), and with CISA via report@cisa.gov.

This operational transparency helps detect ongoing campaigns earlier and enables collaborative countermeasure development.

If I Had to Conclude

Interlock is a clear illustration of the evolving nature of ransomware campaigns. Though not groundbreaking in terms of its technical sophistication, the combination of accessible tools, well-crafted social engineering, and poor cyber hygiene is often enough to compromise an entire organization.

The recommendations in the advisory are simple, effective, and immediately actionable without significant investment. The best collective defense lies in the consistent application of good practices and the sharing of threat intelligence.

Thanks to CISA for sharing this advisory. And as one podcaster would say:

“We don’t think, we patch!™”

Enjoy!

Sources