Summary Points
-
Emergence of FileFix: Hackers are now using the ‘FileFix’ technique in Interlock ransomware attacks, focusing on stealthy social engineering methods to deliver a remote access trojan (RAT), marking a shift from the previously utilized ClickFix approach.
-
KongTuke Web Injector: Interlock ransomware has leveraged the KongTuke web injector to deliver payloads via compromised websites, prompting users to execute disguised PowerShell commands, leading to RAT installation.
-
Post-Infection Activities: After execution, the RAT collects system and network data, performing tasks like Active Directory enumeration and lateral movement, aided by command and control (C2) commands from attackers.
- Noteworthy Victims: Since its launch in September 2024, Interlock ransomware has targeted prominent organizations, reflecting hackers’ adaptability and the evolving tactics in cyber threats, as evidenced by the adoption of the FileFix technique.
The Core Issue
In a notable evolution within the realm of cyber threats, hackers have recently adopted a sophisticated technique named ‘FileFix’ in their Interlock ransomware attacks, leading to the deployment of remote access trojans (RATs) on their targets. This shift in methodology, primarily observed by researchers at The DFIR Report and Proofpoint since May, signifies the adaptation of threat actors in response to evolving security measures. Initially utilizing the KongTuke web injector—where victims, lured by compromised websites, were tricked into executing malicious PowerShell scripts through deceptive prompts—the attackers have now transitioned to the more insidious FileFix technique. This approach weaponizes trusted Windows UI elements to coax users into inadvertently running harmful code, masqueraded as benign file paths, facilitating the infiltration of PHP-based RATs.
The Interlock ransomware, which emerged prominently in September 2024 and has affected high-profile entities such as Texas Tech University and DaVita, illustrates a troubling trajectory of cybercrime whereby attackers continually refine their tactics to evade detection. The DFIR Report’s documentation underscores the versatility and tenacity of these threat actors, who can manipulate various command and control operations post-infection, thereby enabling lateral movement across networks and persistent access into compromised systems. The documentation serves both as an alarming reminder of current cybersecurity vulnerabilities and as an essential resource for organizations seeking to fortify their defenses against these evolving threats.
Risk Summary
The emergence of the ‘FileFix’ technique within Interlock ransomware attacks poses significant risks not only to the targeted enterprises but also to a wider ecosystem of businesses, users, and organizations. As threat actors exploit trust in familiar Windows user interface elements—deceiving users into executing malicious commands—there’s a heightened potential for widespread malware dissemination across interconnected networks. Should businesses unwittingly fall prey to these tactics, they could inadvertently infect partners, customers, and suppliers, leading to cascading operational disruptions, compromised sensitive data, and significant financial liabilities. Furthermore, the stealthy nature of such attacks complicates detection and mitigation efforts, amplifying the threat landscape and eroding trust in digital systems overall. This evolving methodology thus underscores the imperative for heightened cybersecurity awareness and collaborative defense strategies among organizations, as the ramifications of such breaches are not contained but reverberate throughout the entire business community.
Fix & Mitigation
The escalating threat of Interlock ransomware leveraging the FileFix method underscores the critical need for prompt and effective remediation strategies.
Mitigation Strategies
- Regular Backups: Maintain updated backups in isolated environments.
- Endpoint Security: Implement robust antivirus and antimalware solutions.
- User Training: Educate employees on phishing and other social engineering tactics.
- Network Segmentation: Divide networks to limit lateral movement of ransomware.
- Access Controls: Enforce the principle of least privilege across systems.
- Patch Management: Update software and systems regularly to close vulnerabilities.
NIST Guidance
The NIST Cybersecurity Framework (CSF) emphasizes proactive risk management to avert ransomware attacks. For detailed processes related to incident response and recovery, refer to NIST SP 800-61 for Incident Response and NIST SP 800-53 for Security and Privacy Controls.
Stay Ahead in Cybersecurity
Stay informed on the latest Threat Intelligence and Cyberattacks.
Learn more about global cybersecurity standards through the NIST Cybersecurity Framework.
Disclaimer: The information provided may not always be accurate or up to date. Please do your own research, as the cybersecurity landscape evolves rapidly. Intended for secondary references purposes only.
Cyberattacks-V1
