Trusted Design

Interlock and Rhysida within the Ransomware Ecosystem

概要

This analysis examines over two years of observations on the ransomware ecosystem surrounding Interlock and Rhysida threat groups. Hive0163 (Interlock) employs custom malware including NodeSnake, InterlockRAT, JunkFiction downloader, Supper, and Interlock ransomware, with identified links to TAG-124. Rhysida actors utilize Endico downloader, Broomstick, Supper, and Tomb crypter, showing relationships with IceNova operators and ITG23. Strong code overlaps between NodeSnake, JunkFiction downloader, InterlockRAT and Supper indicate shared codebases or common developers. Both groups primarily target U.S. organizations across multiple sectors, using trojanized installers, ClickFix campaigns, and traffic distribution systems for initial access. Analysis of post-exploitation payloads reveals broad, adaptable toolsets including custom WDAC policies, credential phishing tools, and various privilege escalation exploits, demonstrating sophisticated ransomware operations.

Created: 2026-07-12

Indicators

• FileHash-SHA1 - ab420e67f5b2ba45702674a7fe3e10e9d4283732 -
• FileHash-SHA256 - 097f139304307375cd41bb2dc3913166e9f05f0d6bf5aad1efdc081dbf07c68d -
• FileHash-MD5 - fb7c39b75beab3a7b96815f7e31d72ca -

類似Pulses

類似するPulseは見つかりませんでした。

このPulseに関連する脅威アクター (事実ベース)

事実ベースの脅威アクターは見つかりませんでした。

このPulseに関連する脅威アクター (推論ベース)

推論ベースの脅威アクターは見つかりませんでした。

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

---

← Pulse一覧に戻る