IBM X-Force research highlights a strong connection between the Interlock (Hive0163) and Rhysida ransomware ecosystems. The report outlines an intricate network of shared malware families, specialized crypters, and coordinated initial access brokers. Interlock appears to be a highly mature threat group using custom tooling such as NodeSnake and InterlockRAT, and it may have evolved from operators previously associated with Rhysida.
X-Force carried out long-term research over more than two years, analyzing malware samples, attack chains, and staging infrastructure. The investigation uncovered substantial code similarities across multiple backdoors and tracked the development of dedicated crypters such as JunkFiction and Tomb. Researchers also mapped ties between threat actors and initial access brokers through overlapping infrastructure and tool usage.
Organizations should deploy strong endpoint detection and response capabilities to identify suspicious process behavior, including unexpected PowerShell activity and unauthorized registry changes. Prompt patching of internet-facing network devices is essential to reduce the risk of exploitation, including vulnerabilities such as CVE-2026-20131. Enforcing strict WDAC controls and monitoring for unapproved RMM tool activity can also limit post-compromise operations.
If Interlock or Rhysida activity is suspected, isolate impacted systems immediately to stop lateral movement through RDP or SOCKS5 tunnels. Conduct a thorough review of staging infrastructure and check for unauthorized remote management tools such as ConnectWise ScreenConnect. Review logs for suspicious PowerShell execution and investigate any unauthorized changes involving scheduled tasks or systemd services.
Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.
Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.
Attack Narrative & Commands: The adversary has successfully compromised a developer’s workstation via a supply chain attack (T1195.003). They have dropped a malicious Node.js payload named InterlockRAT.js into a temporary directory. The goal is to establish a persistent backdoor to facilitate lateral movement within the network. The attacker executes the script using the node runtime, passing specific arguments to initialize a SOCKS5 proxy for tunneling traffic. This specific command is designed to trigger the existing detection logic.
Regression Test Script:
Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
