#threatreport #HighCompleteness
Interlock and Rhysida within the Ransomware Ecosystem | 12-06-2026
Source:
ibm.com/think/x-force/interl…
Key details below ↓
🧑💻Actors/Campaigns:
Hive0163
Kongtuke
Fin12
Interlock
Vice_society
Unc2565
Storm-0494
Fox_tempest
Storm-0249
Itg25
💀Threats:
Interlock, Rhysida, Nodesnake, Interlockrat, Junkfiction, Supper_backdoor, Zapcat, Kongtuke, Pkr_mtsi_tool, Endico, Oyster, Textshell, Latrodectus, Inc_ransomware, Gootkit, Socgholish_loader, Clickfix_technique, Mintsloader, Dave_loader, Modelorat, Trickbot, Conti, Emotet, Icedid, Ryuk, Cornflake, Windytwist, Berserkstealer, Ntlmthief_tool, Portstarter, Systembc, Junk_code_technique, Antidebugging_technique, Api_hammering_technique, Vidar_stealer, Dead_drop_technique, Nltest_tool, Donut, Azcopy_tool, Winpmem_tool, Printnightmare_vuln, Advanced-port-scanner_tool, Screenconnect_tool, Sliver_c2_tool, Credphish_tool,
🎯Victims: United states
🔓CVEs: CVE-2023-36036 \[[Vulners](
vulners.com/cve/CVE-2023-360…)]
- CVSS V3.1: *7.8*,
- Vulners: Exploitation: True
Soft:
- microsoft windows_10_1507 (<10.0.10240.20308)
- microsoft windows_10_1607 (<10.0.14393.6452)
- microsoft windows_10_1809 (<10.0.17763.5122)
- microsoft windows_10_21h2 (<10.0.19041.3693)
...
CVE-2026-20131 \[[Vulners](
vulners.com/cve/CVE-2026-201…)]
- CVSS V3.1: *10.0*,
- Vulners: Exploitation: True
Soft:
- cisco secure_firewall_management_center (6.4.0.13, 6.4.0.14, 6.4.0.15, 6.4.0.16, 6.4.0.17)
📚TTPs:
⚔️Tactics: 1
🛠️Technics: 0
🤖LLM extracted TTPs:`
T1018, T1021.001, T1027.002, T1027.016, T1036, T1041, T1053.005, T1059.001, T1068, T1070.004, ...
🧨IOCs:
- Hash: 72
- File: 8
- Command: 7
- Url: 9
- Domain: 89
- IP: 73
💽Software: Linux, yInstaller, PyInstaller, Microsoft Teams, Microsoft Edge, TryCloudflare, Steam, Telegram, MSSQL, Windows Defender Application Control, ...
🔢Algorithms: xor, aes-256, zip, sha256, lzma, rc4, cbc
🔠Functions: Write-Output
🗂️Win API: VirtualProtect, RefreshPolicy
📜Programming Languages: javascript, java, python, php, powershell
💻Platforms: x64, arm
#threatreport:
IBM X-Force has conducted extensive research on the ransomware ecosystem involving the Interlock and Rhysida groups, exploring their operational behaviors, malware families, and the interconnections between various threat actors. Interlock, identified as Hive0163, employs a wide range of custom malware, including NodeSnake, InterlockRAT, and Supper, alongside their own ransomware variations. A notable finding is the correlation with TAG-124, suggesting a shared resource pool or collaboration between certain actors in the ransomware scene. The Rhysida group, which operates under a Ransomware-as-a-Service (RaaS) model since 2023, similarly uses malware including the Endico downloader, Broomstick, and Tomb crypter, hinting at a potential relationship with IceNova operators.
The research revealed significant overlaps between several malware families, indicating that they either share a common code base or have been developed by a collaborative group. Specifically, the NodeSnake, InterlockRAT, and Supper malware exhibit strong code relationships, with NodeSnake functioning primarily as a downloader that fetches further payloads and establishing connections to various command and control (C2) servers.
Initial access to networks has commonly been facilitated through initial-access brokers (IABs) using methods like Gootloader or SocGholish, often redirecting users to legitimate-looking sites. These brokers utilize traffic distribution systems to enhance their targeting effectiveness. Notable instances connected to Interlock involved JunkFiction dropper campaigns, while Rhysida actors leveraged specific trojanized installers that facilitated subsequent ransomware deployment through tools like the Endico downloader.
Malware behaviors are characterized by multi-layered methods involving downloaders and crypters. Downloaders, such as the JunkFiction downloader, are used for initial foothold establishment in compromised environments before deploying backdoor malware for post-compromise activities. JunkFiction has been particularly noted for its versatile functionalities and obfuscation techniques.
Supper and InterlockRAT's backdoors are recognized for providing critical persistence mechanisms, utilizing reverse shells and SOCKS5 tunneling for stealthy operations. Both display similar internal structures and command capabilities, with Supper appearing to be more broadly utilized across different incidents compared to InterlockRAT, which has been primarily relegated to Interlock operations alone.
The study also highlights significant developments regarding the effectiveness of crypters used by these actors, such as the custom Tomb crypter, which has undergone iterations to remain undetected by security software. The approaches employed in malware execution and responses to security protocols indicate a relatively sophisticated level of operational capability among these threat groups.
While IBM X-Force's findings indicate a possible lineage between the Interlock and Rhysida actors, the operational specifics and the exact nature of their relationship remain unclear. The dynamic nature of the ransomware ecosystem, empowered by innovations in malware and a decrease in the cost of entry for cybercriminal operations, continues to evolve, revealing complex interactions between different players in the threat landscape.