Feds Warn Health, Other Sectors of Interlock Threats

U.S. authorities are warning of threats posed by double-extortion gang Interlock, which has been hitting an assortment of businesses across many industries, including healthcare and other critical infrastructure sectors, with a ransomware variant first seen in September 2024.

See Also: Top 10 Technical Predictions for 2025

The joint alert on Tuesday from the Cybersecurity and Infrastructure Security Agency, the FBI, the U.S. Department of Health and Human Services and the Multi-State Information Sharing and Analysis Center said Interlock, which exfiltrates data then encrypts victims’ systems with ransomware, has been targeting organizations across North America and Europe.

As of Wednesday, Interlock’s dark website included a long list of alleged victims across many sectors, including healthcare providers, schools, construction, manufacturing and real estate.

Listed among Interlock’s recent healthcare victims are Ohio-based Kettering Health, which operates 14 medical centers and more than 120 outpatient facilities in Western Ohio, and Colorado-based DaVita Inc., which runs more than 3,100 dialysis and other kidney care facilities in the U.S. and in 13 other countries.

Interlock ransomware encryptors are designed for both Windows and Linux operating systems, the federal alert said. “These encryptors have been observed encrypting virtual machines across both operating systems,” the alert said.

Unlike most ransomware groups, Interlock obtains initial access via drive-by download from compromised legitimate websites, the joint advisory said.

“Actors were also observed using the ClickFix social engineering technique for initial access, in which victims are tricked into executing a malicious payload under the guise of fixing an issue on the victim’s system. Actors then use various methods for discovery, credential access and lateral movement to spread to other systems on the network,” the advisory said.

The alert also notes that Interlock ransomware appears to have some similarities with Rhysida ransomware variant, including code overlaps in the binaries of both.

‘Ideal Targets’

Security researchers have been keeping a close eye on Interlock since the group first emerged last September.

“There’s no clear indication that Interlock is deliberately singling out the healthcare sector – like many ransomware operators, they appear to pursue essentially opportunistic targets wherever vulnerabilities present themselves,” said Kilian Seznec, a cyberthreat intelligence and detection analyst at security firm Sekoia.io, which issued a report about Interlock threats in April.

“Interlock is an active group. However, keep in mind that their overall victim count is modest compared with major players such as Clop, Akira or Qilin,” he said. To put it in perspective, Interlock has claimed 42 victims so far this year, while those larger gangs have each exceeded 350.

In addition to using drive-by downloads and the rare ClickFix method to deploy payloads, the gang also employ a custom backdoor alongside what appears to be a bespoke packer. “Taken together with their relatively small affiliate base, this gives their operations a more handcrafted or ‘artisanal’ feel, as opposed to the industrial scale seen with some other ransomware families,” he said.

Interlock’s FileFix and ClickFix techniques bypass traditional endpoint defenses, said JP Castellanos, director of threat intelligence at security firm Binary Defense.

“They are using native binaries or payloads that look trusted because it requires a bit of social engineering by Interlock to get the users to use either technique. They are not relying on macros or exploits, but deceiving the user to execute either technique,” he said.

Unpatched electronic health record systems and unsecured internet of medical things devices are potentially prime targets for Interlock attackers, he said.

“These present ideal targets for ransomware groups like Interlock due to their inherent vulnerabilities, criticality and systemic interdependencies,” he said. In many instances, these systems are not properly segmented on the network, so once a network breach occurs, a sophisticated attacker can move laterally to gain access to them, he said.

“Since the EHR and IoMT devices are often running out of data software and firmware, and on delayed patch cycles, this makes it relatively easy to exploit. The real bounty for ransomware groups is to be found in EHR, since this gives them a load of valuable data,” he said.

“However, the growing ability to disrupt medical devices inside a hospital creates a more high-pressure, embarrassing and potentially dangerous situation for these healthcare providers. This helps in putting pressure on the organization for the ransom negotiations.”

Among the factors contributing to Interlock and other cyberattack threats is that many healthcare sector entities have networks that are “too flat,” said Dave Chronister, an ethical hacker and CEO of Parameter Security.

Many of these organizations aren’t doing rigorous segmentation, “particularly in terms of separating front office systems from the more sensitive and vulnerable platforms like EHR and IoMT devices,” he said.

The recent attack on Kettering Health is “a prime example” of the challenges healthcare organizations are facing once they are targeted and hit by gangs like Interlock, Chronister said. “In that incident, Interlock was able to move laterally across the network, impacting EHR, phone lines and internal systems.”

“Security teams need to isolate and segment these high-risk assets.”

Taking Action

The Health Information Sharing and Analysis Center has observed 51 Interlock attacks against all sectors since the group appeared in the last quarter of 2024, with seven of those targeting healthcare, said Errol Weiss, chief security officer at Health-ISAC.

“Interlock is particularly concerning because, beyond ransomware encryption, they routinely engage in data theft and data extortion. This double-extortion model significantly increases the risk to patient privacy and regulatory compliance,” he said.

“With Interlock’s primary focus on the health sector, defense industrial base and other critical infrastructure sectors, their attacks have high potential for disrupting critical services and directly impacting patient safety and clinical continuity.”

Weiss strongly encourages organization to implement critical security best practices and controls, including multi-factor authentication for all critical accounts, privileged users, virtual private networks and email systems.

Stay up to date on patches, back up critical systems and test the backups, actively participate in information-sharing communities to stay informed about emerging threats, develop and regularly test an incident response plan; and provide ongoing cybersecurity awareness training to staff, he advised.

“This situation underscores the immense value of timely, peer-to-peer threat intelligence communities like Health-ISAC, where incident details from a victim were shared, which then provide crucial information for network defenders to proactively block and detect malicious activity,” he said.

“While government alerts are helpful for broad awareness, sector-specific ISACs often provide more granular, actionable intelligence sooner.” The Health-ISAC and American Hospital Association in May issued a joint advisory about Interlock for their members with known indicators of compromise, he said.