Interlock and Rhysida Ransomware Operations Share Supper Backdoor and Malware Codebase

Cybersecuritynews •Tushar Subhra Dutta • June 16, 2026

Two of the more active ransomware groups operating today, Interlock and Rhysida, have more in common than previously thought. New research shows both groups a backdoor called Supper, and that several of their malware tools appear to have grown from the same original code. The Interlock group, tracked internally as Hive0163, has been running […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Rhysida and Interlock Ransomware Groups Exploit Shared Malware Ecosystem Recent analysis reveals that Rhysida and Interlock ransomware groups are interconnected through a shared ecosystem of malware tools, including the Supper backdoor. Both groups utilize initial access brokers and a variety of downloaders and crypters to stage their attacks. The research highlights that their operations rely on a layered approach rather than a single malware family, indicating a complex relationship. Interlock is linked to TAG-124 and employs various methods such as trojanized installers and traffic distribution systems for payload delivery. Rhysida's tactics include fake software download sites and signed installers, showcasing a trend towards industrialized access methods. The overlapping tools and techniques suggest shared development or a tightly knit criminal service market. This evolving threat landscape necessitates a broader detection strategy that goes beyond final encryptors to include initial access brokers and downloader infrastructure. 3 sources 52

Extracted Entities

Interlock and Rhysida Ransomware Operations Share Supper Backdoor and Malware Codebase

The full story

Extracted Entities

Attack Types (1)

Malware (1)

Ransomware Groups (2)