interlock
ransomware group · aka Interlock, Interlock ransomware · unknown · active since 2024-09
Victims · 7d
2▲1 vs prev. week
Victims · 30d
5active targets
Victims · 90d
16
All-time (tracked)
126since 2024-10-14
Last post
09-15 20:33UTC
Estimated earnings
—public reporting
Profile · glm-5.3-flash · updated
Interlock is a ransomware and data-extortion group first documented by vendors in September 2024 (Trend Micro, 2024). It is notable for fielding encryptors for Windows, Linux, and FreeBSD, including use against NAS appliances, and for being among the first ransomware operations to adopt the 'ClickFix' fake CAPTCHA/browser-update social-engineering chain (Sucuri, 2024). Vendor research in 2025 documented a Rust-based Interlock RAT used alongside the encryptor, with later versions hiding configuration in images. No public attribution to a country or named leadership is available. Public victim reporting is limited; the group has been linked to the City of West Plains, Texas DOT, and, per this dashboard's tracking, NFM Lending (posted 2026-09-07).
Tactics & tooling
- ClickFix social engineering: fake 'verify you are human'/CAPTCHA or fake browser-update prompts on compromised websites trick users into running PowerShell commands that fetch the payload (Sucuri, 2024).
- PowerShell-based delivery chains using Invoke-Expression and attacker-controlled download URLs.
- Multi-platform encryptors for Windows, Linux, and FreeBSD; deployed against NAS devices such as QNAP and Synology (Trend Micro, 2024).
- Rust-based Interlock RAT deployed for post-access operations alongside ransomware; 2025 versions reportedly hide configuration in images via steganography (vendor research, 2025).
- Double extortion: steals data pre-encryption and threatens publication on a Tor leak site.
- Targets internet-exposed servers and appliances; no widely reported reliance on specific CVE exploitation for initial access.
- Reconnaissance and data staging on compromised servers before encryption and leak-site posting.
Targeted sectors
government (municipal and state agencies)healthcarefinancial servicestechnology/IT services
Notable public victims
Devon International Group (US conglomerate; listed on Interlock leak site, October 2024), City of West Plains, Missouri (confirmed ransomware attack, November 2024), Texas Department of Transportation (incident confirmed by TxDOT; Interlock claimed ~35 GB of stolen data, May 2025), NFM Lending (listed on Interlock leak site, per this dashboard's tracking, 2026-09-07)
Estimated earnings
No public figure.
Leak-site victims126 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| Drive Products | · Apr 4, 2025 | https://www.driveproducts.com Drive Products offers a complete range of truck mounted equipment, products, services and solutions through a growing branch and partner network across Canada. Drive Products has continued to build on its diversification strategy centered around strong distribution, systems integration, upfitting and manufacturing capabilities. |
| Doman | · Apr 4, 2025 | https://www.domanbm.com Doman Building Materials Group is a vertically integrated global building materials group. They supply products to retailers across North America. From basic lumber to next generation products, DOMAN optimizes the supply of a wide range of quality building materials. Headquartered in Vancouver, British Columbia, Canada, we operate distribution centers, wood processing plants, specialty sawmills, planers, wood cleaning facilities across North America and private forest lands. This distinctive vertical model allows us to maintain close relationships with the supply chain, ensuring retailers can purchase high-quality products at highly competitive prices. Doman Building Materials Group Ltd. is traded on the Toronto Stock Exchange under the symbol DBM |
| Cherokee County School District | · Apr 4, 2025 | https://www.cherokee1.org The school nurse has the expertise to identify, assess, plan, implement, and evaluate the health needs of the individual student and the school community. School nurses, grounded in ethical and evidence-based practice, are leaders who link health and education, provide care coordination, advocate for quality student-centered care, and collaborate to develop systems that enable individuals and communities to reach their full potential. (Adopted by the National Association of School Nurses Board of Directors, February 2017). But Cherokee County School District, for all its talents, is rather negligent about the security of its network. We present to your attention the personal data of employees, financial and tax reports. |
| National Defense Corp | · Mar 29, 2025 | https://www.nationaldefensecorp.com AMTEC is a manufacturer of lethal and non-lethal ammunition, explosives, and cartridges for military and law enforcement use. Globally, AMTEC is the largest volume producer of 40mm Grenade Ammunition and Fuzing. Their capabilities include precision assembly, explosive load, assemble and pack, metal forming and plating, and primary explosive manufacturing. The company is headquartered in Janesville, Wisconsin. |
| PMA | · Mar 23, 2025 | https://www.pmacanada.com Peter Mielzynski Agencies (PMA) is an importer and distributor of wines and spirits. PMA was founded in 1979 and is headquartered in Ontario, Canada. Since its inception, PMA has become the leading agency for wines and spirits in Canada. Some of the world's premium spirits and wine brands they represent include Grant's Whisky, Glenfiddich Single Malt Scotch, Gibson's Finest Canadian Whisky, Two Oceans Wines, Amarula Cream Liqueur, Jägermeister and Disaronno. |
| General Formulations | · Mar 23, 2025 | https://www.generalformulations.com Founded in 1953, General Formulations is a family owned company located in Sparta, Michigan. We have several solvent and water based coating lines as well as one of the largest converting operations in the industry, specializing in slitting, sheeting, punching and packaging. Our corporate headquarters has 400,000 square feet of manufacturing and converting space to service the ever growing needs of our customers.Spartan Graphics specializes in developing and printing point of purchase and marketing materials. |
| Aztec Municipal School District | · Mar 21, 2025 | https://www.aztecschools.com/ Aztec Municipal Schools is a public school district based in Aztec, New Mexico, United States. The district covers a 413-square-mile area in northeastern San Juan County.Explore financial and tax disclosure materials, employee and student data, and more. |
| Milano | · Mar 12, 2025 | https://www.milano.com.mx Servicios Corporativos Melody-Milano is a company that operates in the Apparel & Accessories Retail industry. It employs 500to999 people and has 100MMto250M of revenue. The company is headquartered in El Centro, Guanajuato, Mexico. We provide you with personal data of employees, tax and financial reports. |
| Hancock Public School | · Mar 7, 2025 | https://hancock.k12.mn.us/ Hancock Public School is a K-12 educational institution that emphasizes excellence in education, as evidenced by its recognition with the National Blue Ribbon School Award. The school serves students from preschool through high school and offers a variety of academic programs and extracurricular activities, including sports. It aims to foster a supportive community for families and encourages student achievement through various awards and recognition programs. Hancock Public School is dedicated to creating a positive impact on its students and the broader community |
| Wayne County, Michigan | · Feb 28, 2025 | https://www.waynecounty.com/ Wayne County is located in the state of Michigan, United States. We offer you more than 130 SQL databases . A large collection of confidential criminal investigation files, personal data of residents. |
| The Smeg Group | · Feb 28, 2025 | https://www.smeg.com/ Smeg, an acronym of Smalterie Metallurgiche Emiliane Guastalla, is an Italian home appliance manufacturer We present to you a large collection of corporate documents, including a dump of mailboxes of all employees. Company developments and personal data of employees. |
| The Siegel Group, Inc. | · Feb 22, 2025 | https://www.siegelcompanies.com/ The Siegel Group, Inc. is a full service commercial real estate firm based in Las Vegas, Nevada and Studio City, California. It is a developer and operator of multi-family, extended stays, flexible stays, retail, hospitality, hotel-casinos, and land development. We present you more than 11TB of the company's data, here you will find the SQL databases, personal data of all employees and much more. |
| McCormick & Priore | · Dec 26, 2024 | https://www.mccormickpriore.com/ McCormick & Priore is a defense litigation firm known for having the intensity and integrity to go beyond expectations - something we call "outperformance. This includes being large enough to provide the in-depth legal expertise and support clients need and yet focused enough to also provide the individualized attention successful litigation requires We present to your attention a large collection of SQL databases, confidential data of employees and clients. |
| City of Noblesville | · Dec 19, 2024 | https://www.noblesville.in.gov/ City of Noblesville is a company that operates in the Government industry. It employs 250to499 people and has 25Mto50M of revenue. The company is headquartered in Noblesville, Indiana We present to your attention, a large SQL database, confidential data of employees, confidential data of the Police, and emergency services. |
| Heritage Bank | · Dec 17, 2024 | https://www.ourheritage.bank/ Heritage Bank USA provides commercial banking services. Heritage offers a broad line of banking and financial products and services with the personalized focus of a community banking organization. You can immerse yourself in banking and we can help you do it. Confidential banking documents, personal data of employees and customers, credit reports. Technical documentation, and ATM statements. And much more. Enjoy browsing. |
| Brockton Neighborhood Health Center | · Dec 17, 2024 | https://www.bnhc.org/ Brockton Neighborhood Health Center is a multicultural organization that collaborates with community agencies and residents to provide high quality comprehensive health care that is responsive to community health needs and is linguistically, culturally and financially accessible. We present to your attention a large SQL database, a collection of confidential documents of patients and employees. |
| Boston Chinatown Neighborhood Center | · Dec 9, 2024 | https://www.bcnc.net/ For more than 50 years, BCNC has been providing new immigrants, especially Asians, with the support and resources they need to thrive in the United States. With deep roots in Boston's Chinatown neighborhood, BCNC now serves people from three locations in Greater Boston and the South Shore We present you with personal data of employees, contracts and much more. |
| RJM Marketing | · Dec 6, 2024 | https://www.rjmichaels.com/ Who is RJM Marketing. Founded in 1980, RJM has provided advertising and marketing services to clients across the United States. While founded in the era of traditional m edia and print, they have expanded their services over the years to become a leader in the ever-changing digital world. We present you with employee personal data, contracts and much more. |
| Indesign, LLC | · Nov 19, 2024 | https://www.indesign-llc.com/ Indesign, LLC is a multi-discipline engineering design firm that provides full turnkey electronic product. We can share with you developments for big companies like Microsoft, IBM, Rolls-Royce, Intel, and many more. Large sql database, complete development projects, personal data of employees and much more. |
| Winnebago Public School Foundation | · Nov 7, 2024 | https://www.winnebagopublicschools.org/ Winnebago Public School Foundation Inc is a company that employs 20 to 49 people and has 1Mto5M of revenue. The company is headquartered in Winnebago. In your disposition , personal data of employees and students, SQL databases. |
| Texas Tech University Health Sciences Center | · Oct 27, 2024 | https://www.ttuhsc.edu/ Beginning in 1969 as the Texas Tech University School of Medicine, Texas Tech University Health Sciences Center (TTUHSC) is now a five-school, comprehensive health-related university with campuses in Abilene, Amarillo, Dallas/Fort Worth, Lubbock and Midland/Odessa. We present to you a large collection of confidential documents, including - patient data, medical research, a large set of SQL databases. |
| Legacy Treatment Services | · Oct 26, 2024 | https://www.legacytreatment.org/ Legacy Treatment Services has locations in Burlington, Atlantic, Camden, and Middlesex counties. They offer mental and behavioral health services, addiction services, counseling, medication management and more. And we offer you internal documents, patient records, and a large SQL database. |
| Drug and Alcohol Treatment Service | · Oct 24, 2024 | https://www.datsrecovery.org/ Drug and Alcohol Treatment Service is Lackawanna County's leading outpatient drug and alcohol treatment center. The focus of treatment at DATS is centered on changing destructive behaviors and developing a lifestyle free of mood altering drugs. At your disposal is the SAGE accounting database, personal data of employees, SQL database, personal data of patients |
| Smeg | · Oct 24, 2024 | https://www.smeg.com/ Smeg, an acronym of Smalterie Metallurgiche Emiliane Guastalla, is an Italian home appliance manufacturer We present to you a large collection of corporate documents, including a dump of mailboxes of all employees. Company developments and personal data of employees. |
| Wayne County | · Oct 23, 2024 | https://www.waynecounty.com/ Wayne County is located in the state of Michigan, United States. We offer you more than 130 SQL databases . A large collection of confidential criminal investigation files, personal data of residents. |
| Cathexis Holdings LP | · Oct 14, 2024 | https://www.cathexis.com/ Today, we unveil nearly 3 million files from the "Cathexis Holdings LP" corporate network. Dive into a wealth of SQL databases, email backups, and an expansive collection of corporate documents that offer unparalleled insights into one of the most diverse investment firms out there. Now, the information that drives billion-dollar decisions is at your fingertips, absolutely free! Transform your business with data that others pay a fortune for your path to insider knowledge starts today |
In the newsAll →
No articles mention this group yet.
Victim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .