How to protect yourself from Interlock and Warlock ransomware: a tactical and practical guide

Informatec Digital » Resources » How to protect yourself from Interlock and Warlock ransomware: a tactical and practical guide

Ransomware continues to dominate the cybersecurity agenda , and within that landscape, two names stand out: Interlock and Warlock. Both groups have scaled their activity in a very short time, prompting companies and organizations to urgently review their defenses and strengthen prevention measures to minimize the risk of disruptions, data breaches, and financial losses.

This is not a passing fad: in the first half of 2025, there was a 47% increase in attacks compared to the same period of the previous year (3.627 versus 2.472). This increase is not only due to established gangs ; it also reflects the emergence of new actors who have refined their tactics, techniques, and procedures (TTPs) and honed their social engineering to gain initial access more effectively and with less noise.

Current situation: why Interlock and Warlock are worrying

Interlock, Warlock, and SafePay have gone from being "new names" to threats with a tangible impact in a matter of months. Interlock appeared at the end of 2024 and quickly racked up more than 20 intrusions against sensitive sectors such as healthcare, public administration, and education; Warlock emerged as a Ransomware-as-a-Service (RaaS) operation in March 2025 and has accumulated more than 60 victims; and SafePay took off with more than 200 incidents in the first quarter of 2025 alone.

This dynamism has triggered formal alerts. CISA, along with other agencies, has issued a specific warning (referenced as aa25-203a) regarding the escalation of Interlock. The underlying message is clear: attackers are accelerating their innovation cycle, exploiting process gaps, and taking advantage of credentials and vulnerabilities at a rate that is difficult to match without adopting a layered, zero-trust security approach.

The victims are not just large corporations; it also impacts SMEs and critical regional entities. Warlock, for example, hits the technology, finance, and telecommunications sectors hard , focusing on the United States, Japan, and the United Kingdom. SafePay, meanwhile, shows a particular predilection for targets in the United States (103 confirmed cases, nearly 40% of the total), and also operates in Germany, Australia, the United Kingdom, and Latin America (Mexico, Colombia, and Argentina).

It's worth highlighting the double extortion as a common denominator: attackers encrypt and exfiltrate data to maximize pressure. In the case of Interlock, there are high-profile incidents like the DaVita breach in the United States, with 1,5 terabytes leaked (patient records, clinical information, user accounts, and financial data), illustrating the depth and reputational damage of these campaigns.

Another constant: security systems take too long to detect intrusions. Industry studies estimate that incidents can go undetected for more than 250 days and cost an average of nearly $4,99 million. This window of opportunity for criminals is drastically reduced when high-quality telemetry, behavioral detection, and a well-rehearsed containment strategy are combined.

Interlock: social engineering “ClickFix”, customized RAT and stealthy persistence

Interlock has adopted unusual and highly effective access methods. Its hallmark is the ClickFix social engineering technique , which tricks the victim into running scripts disguised as troubleshooting windows or fake CAPTCHAs. Behind this maneuver, an obfuscated PowerShell script (encoded in Base64) can launch payloads, deploy its own RAT, and initiate lateral movement.

During 2025, a modified variant of ClickFix was observed being used to download a new iteration of its RAT in PHP, increasing its persistence and remote control capabilities . This agent places itself at startup and anchors itself to the system by modifying the "Chrome Updater" registry key in Windows, ensuring its execution after restarts and reducing the likelihood of being removed by superficial measures.

Once inside, Interlock typically gathers system information and credentials , using tools such as Cobalt Strike, SystemBC, its own Interlock RAT5, or NodeSnake RAT. It's not uncommon to see utilities for stealing keys and keystrokes (for example, components like "cht.exe" and "klg.dll"), as well as the use of known stealers (Lumma, Berserk) to escalate privileges.

To exfiltrate data, the group combines cloud and traditional channels : Azure Storage Explorer and AzCopy, in addition to WinSCP, are frequent tools in their toolkit. Lateral movement is often performed using RDP, AnyDesk, and PuTTY, and techniques such as Kerberoasting have been observed for capturing tickets and gaining access to high-privilege accounts.

An important distinction is the focus on encrypting virtual machines, initially leaving out physical hosts or servers . This pattern could evolve, but it has been reported in several recent intrusions. Similarities have also been identified with ransomware families like Rhysida, as well as peculiarities in its extortion method: the ransom note may include a unique code and channel contact via Tor, without initially demanding a specific ransom note.

Warlock: RaaS and ToolShell exploit chain against SharePoint

Warlock, also known as Gold Salem or Storm-2603, uses a ransomware-as-a-service model. Its most striking feature is its initial access through zero-day vulnerabilities in Microsoft SharePoint, chained together in what the community has dubbed ToolShell. Associated CVEs include CVE-2025-49706, CVE-2025-49704, CVE-2025-53770, and CVE-2025-53771.

Following the initial intrusion, the attack prioritizes the exfiltration of financial data, internal records, and customer or employee lists , culminating in encryption and a double extortion attempt. Within a few months, it had surpassed 60 victims, particularly affecting the technology, financial services, and telecommunications sectors, with the United States, Japan, and the United Kingdom ranking highest in risk assessments.

The operational lesson is straightforward: if your organization exposes SharePoint or critical web services, patch management and attack surface hardening are essential. Limiting exposure, reviewing authentication, thoroughly logging access, and deploying targeted detection for anomalous behavior in SharePoint significantly reduces the attack vector.

Implementing MFA and conditioning access with contextual policies (device, location, risk) significantly reduces the tactical advantage operators gain when credentials or cookies are compromised. Adding network segmentation and stringent access control lists further diminishes the room for maneuver within the environment.

SafePay: volume, global reach and similarities with LockBit 3.0

SafePay launched in the second half of 2024, but it was in 2025 that it became one of the most active encryption programs . In the first quarter alone, it handled over 200 incidents. It is often compared to LockBit 3.0 for its capabilities and modularity.

Their targets are spread across the globe, although the United States accounts for the majority of confirmed victims. The hardest-hit industries include manufacturing, technology, education , professional services, and healthcare. Initial access is achieved through various means, including stolen credentials, exploitation of exposed remote services (VPNs and similar), and poorly patched known CVEs.

Once established, it extends control through lateral movement and password theft, and executes a two-stage extortion strategy (leakage + encryption) to maximize its leverage. The recommendation: strong password policies with MFA, scheduled external exposure reviews, hardened VPNs, and microsegmentation to curb spread across domains and networks.

Early detection and threat hunting: from theory to practice

If Interlock and Warlock demonstrate anything, it's that visibility is everything. Real-time monitoring with SIEM, EDR , and IPS systems , combined with threat hunting, reduces dwell time and prevents an intrusion from becoming a critical incident.

The community provides collections of rules mapped to MITRE ATT&CK and enhanced with CTI to cover the TTPs of Interlock and other operators. Having detections ready for multiple SIEMs, EDRs, and data lakes , complete with metadata, references, timelines, and triage guides, accelerates hypothesis validation and response.

To organize tactical content, it's helpful to tag searches and rules with terms like "Interlock Ransomware" or "aa25-203a," and create dashboards focused on key activities (e.g., PowerShell with Base64, suspicious registry modifications to startup keys, anomalous RDP/AnyDesk usage, Kerberoasting patterns, and exfiltration utilities). AI-assisted detection IDEs help transform threat reports into cross-platform, portable queries.

Prevention measures that truly make a difference

Prevention is the first line of defense and must be implemented across all departments, in line with ISO 27001. Train all staff to recognize phishing , deceptive links, and malicious attachments, ideally through regular drills. Awareness isn't an IT luxury: we're all part of the defense, and it only takes one click to open the door.

Prioritized patching is essential. Operating systems, browsers, Java/legacy runtimes, Microsoft Office, and critical components must be up to date. Most campaigns exploit known or newly disclosed vulnerabilities, so a consistent update schedule is your best ally.

Strengthen authentication. MFA on all sensitive accounts significantly reduces password reuse and session hijacking. Apply the principle of least privilege and continuously review administrator permissions, service accounts, and legacy access.

Segmentation and control lists. Separating networks, domains, and environments minimizes the blast radius. Isolate management servers, protect data centers, enforce strict access control lists (ACLs), and disable unused services. Where appropriate, move risky workloads to containers or VDI to limit the scope.

Email and web hardening. Anti-phishing filtering and content analysis reduce the noise that reaches the user. Add DMARC, SPF, DKIM policies, and sandboxed gateways to inspect attachments and URLs before delivery.

Execution control and macros. Disable macros by default in Office for those who don't need them. Apply application whitelists, folder-based rules (e.g., browser temporary files), and policies that limit which binaries can access sensitive file types (e.g., only Word can edit .docx files).

Endpoint instrumentation. EDR/anti-ransomware with behavioral detection , blocking of suspicious execution, and file rollback. Combine this with restricted PowerShell policies, script blocking, and AMSI auditing.

Secure remote access. If using a VPN or remote desktop, enable MFA , restrict access by IP address/country, review access patterns, and disable insecure tunnels. Replace credentials with certificates where feasible and audit the use of tools like AnyDesk or PuTTY.

Action guide if you are already engaged

The priority is containment. Isolate affected equipment and network segments by disconnecting them from the network to slow the spread. Disable automatic backups for the duration of the incident to prevent encryption from contaminating snapshots.

Identify the strain. Analyze the ransom note, extensions, and artifacts . Ransomware identification platforms can help clarify the family to guide action and identify potential free decryption tools.

Eradicate and recover. Run a cleanup with antivirus/EDR , verify that no lingering issues remain, and if you have healthy backups, restore services and data according to a priority plan (business and technical dependencies).

Conduct forensic analysis. Review logs, IOCs, lateral movement paths, accounts used , and potential exfiltration. This not only closes doors but is also key for compliance and stakeholder communication.

Fix and report. Patch, harden configurations, rotate credentials , and formalize lessons learned. Notify the appropriate authorities according to your jurisdiction and sector; transparency fosters a coordinated response.

Is it worth paying the ransom?

Authorities and experts advise against paying. There are no guarantees of decryption even if you give in to the demand; it could make you a recurring target, and in some cases, there are legal implications if the group is sanctioned. Furthermore, it would finance future criminal activities.

The alternative is to strengthen preparedness to avoid reaching that point: robust backups, restoration drills, proactive detection , and expert advice if the situation requires it. Paying is not a security strategy; it's just another risk.

Tools and services that help

To raise the bar for defense, consider suites with endpoint, network, and cloud coverage, along with top-tier firewalls . Endpoint protection, EDR, and MDR solutions enable rapid detection, containment, and response, as well as coordinated forensic analysis and mitigation.

Some vendors offer dedicated ransomware components, including behavioral detection, process isolation, and file restoration. Others integrate inventory, patching, privilege control, and auditing, simplifying governance and reducing gaps between tools.

If your organization needs market reference, there are thematic centers and rule catalogs for advanced detection mapped to MITRE ATT&CK , compatible with various SIEM/EDR/Data Lakes, with actionable CTI, metadata, and triage recommendations. This type of content accelerates defense operations and hypothesis-based hunting.

Policies and habits: “dos” and “don’ts” that work

Make regular, verifiable backups. A proven backup eliminates blackmail and shortens recovery time. Be proactive: design your response strategy now, define roles, and practice it with tabletop exercises.

Use content analysis and filtering in email and on the web. Blocking malicious attachments and URLs before they reach the user drastically reduces the risk. Keep all systems updated: timely patches close vulnerabilities before anyone can exploit them.

Train your teams to detect fraud and manage passwords responsibly. Never share credentials or personal information with unverified sources, and be wary of urgent demands or unusual changes in processes.

Don't pay the ransom or prolong the damage. If you're hit, isolate quickly, stop automatic backups , and prevent encryption from infecting more assets. Prioritize eradication and a clean restore.

Additional controls that enhance security

Professional patch management. Automate the detection and deployment of updates , prioritizing criticality and risk, without disrupting operations. This includes OS, middleware, browsers, and third-party components.

Data-oriented access control. Define rules that block unauthorized processes from modifying sensitive file types (for example, allowing only Word to access .docx files). This way, even if a malicious binary executes, it won't be able to encrypt the important data.

Software rules by folder and context. Restricts execution/reading/writing in key locations (temporary, downloads) and includes exceptions designed to avoid disrupting legitimate workflows (installers, compression).

Disable macros unless absolutely necessary. Many infection chains still use macros in obfuscated documents; blocking them by default cuts off a traditional and highly profitable attack vector for the attacker.

Whitelists and containers. Allows only trusted applications and isolates risky activities in virtualized or contained environments, limiting the impact if something runs by mistake.

People and leadership: influence without “formal authority”

Technology alone is insufficient without sound decisions and coordination. In security, much of the success depends on credibility, trust, and influence rather than positions of authority. Mapping interdependencies (who needs to collaborate, who can block access) and cultivating transparent relationships significantly increases the capacity to implement change.

Organizations are inherently political: different priorities, pressures, and incentives coexist and clash. Effective cybersecurity leadership relies on empathy, clarity, and consistency, building agreements that generate shared value rather than imposing controls arbitrarily.

An allegorical case to remember the lesson

Imagine a threat like Cipherlock, an entity that locks and silences data. The hero doesn't win through brute force, but through containment, analysis, and cutting off propagation routes before launching a counterattack. The lesson: ransomware doesn't punish technology itself, it punishes negligence in its management.

The right tactical combination is clear: constant support, intelligent segmentation, disciplined patching, and continuous training . Every user is an active link in the defense, and every well-organized process is one less lock for the attacker.

Essential tips for digital hygiene

Avoid clicking on unverified links and downloading from dubious sites; unknown USB drives are also a threat vector that should be eliminated. Use a VPN with MFA on public Wi-Fi networks and strengthen your endpoint with modern security measures.

Strengthen your email with automated analysis and anti-spoofing rules. Maintain backups and practice restoration . And reduce the personal data you share: the less you expose, the less it can be exploited.

If your company operates with SharePoint or other exposed surfaces, scrutinize configurations, authentication, and patching . The ToolShell chain exploited by Warlock serves as a reminder that zero-day vulnerabilities exist, but misconfigurations and patch delays are far more common.

Human behavior statistics don't help either: a significant percentage of users open phishing emails , and some even run malicious attachments. Therefore, in addition to training, technical safeguards must be implemented that account for human error as a natural part of the system.

Prevention and effective response are not a destination, they are a practice. Investing in layers of defense, automation, and visibility reduces the attacker's dwell time and mitigates the impact if they manage to breach a first line of defense.

Looking at all of the above in perspective, protecting yourself from Interlock, Warlock, and other emerging gangs requires technique, method, and culture: well-integrated modern technologies, repeatable processes, and aligned teams that know how to detect, contain, eradicate, and recover quickly. Add to that robust backups, MFA everywhere, rigorous segmentation, and continuous monitoring, and the chances of ransomware ruining your business plummet.