FBI Sounds Alarm on ‘Interlock’ Ransomware, Urges Windows and Linux Users to Enable Two‑Factor Authentication

The Federal Bureau of Investigation and the Cybersecurity and Infrastructure Security Agency have issued a joint alert warning that a fast‑growing threat known as Interlock ransomware is actively targeting organisations across North America and Europe. Attackers have developed encryption tools for both Windows and Linux environments, including virtual machines, and are using double‑extortion tactics that combine data theft with system lock‑ups.

How Interlock breaches networks

Investigators say the group relies on drive‑by downloads and a social‑engineering lure called ClickFix—now shifting toward a follow‑up tool known as FileFix—to trick users into installing a remote‑access trojan. Once inside a network, the operators pivot laterally with PowerShell commands, keyloggers and remote‑administration utilities such as AnyDesk and ScreenConnect. Stolen data is siphoned to Azure cloud storage to blend in with normal traffic before the ransomware payload appends “.interlock” or “.1nt3rlock” to encrypted files.

Why the FBI highlights two‑factor authentication

The advisory lists multiple defences, but investigators place special emphasis on enforcing multi‑factor (2FA) log‑ins for webmail, VPNs and any account with access to critical systems. Interlock’s operators depend on harvested credentials for lateral movement, and an extra verification step blocks many of those attempts.

Full mitigation checklist

• Require 2FA on all possible services, starting with remote access and administration tools.

• Deploy web‑application firewalls and DNS filtering to block malicious domains.

• Patch operating systems, firmware and software promptly under a managed schedule.

• Segment internal networks to limit the blast radius of a breach.

• Review servers and Active Directory for unfamiliar accounts and disable unused ports.

• Restrict command‑line utilities that assist privilege escalation.

• Maintain an offline, tested backup and recovery plan so business‑critical data can be restored without ransom payments.

Industry reaction

Security analysts warn that Interlock is unusual in using compromised websites for drive‑by malware downloads and in shifting toolsets quickly to evade detection. They recommend reinforcing user‑awareness programmes so staff can recognise fake update prompts and understand the organisation’s legitimate patching processes.

What to do now

CISA and the FBI urge IT and security teams to consult advisory AA25‑203A for indicators of compromise, report any Interlock activity to federal authorities and implement the recommended controls without delay. For individuals and small businesses, the most immediate step is simple: activate two‑factor authentication wherever it is offered and keep devices patched. The extra login hurdle could be the difference between business as usual and a costly ransomware shutdown.

Photo Credit: DepositPhotos.com