Interlock Ransomware Uses Gaming Anti-Cheat Driver Exploit to Disable Security Tools

Fast Facts

1. The Interlock ransomware group operates as a small, sophisticated team that develops proprietary malware, primarily targeting the education sector in the US and UK, and uses a double-extortion tactic involving data theft and encryption.
2. Their attacks often start with MintLoader infections via social engineering, then deploy tools like NodeSnakeRAT and AZcopy to establish persistence, move laterally, and exfiltrate data before encryption.
3. A key innovation is their use of “Hotta Killer,” a custom evasion tool leveraging a zero-day vulnerability in gaming drivers (CVE-2025-61155), enabling them to disable EDR and antivirus defenses by terminating security processes.
4. Organizations must enhance defenses by blocking unauthorized remote access, restricting SMB/RDP connections, and preventing PowerShell-based payload downloads to counter Interlock’s evolving exploitation techniques.

The Issue

The Interlock ransomware group has become a significant threat, particularly targeting educational institutions in the US and UK. Unlike larger ransomware operations that operate through Ransomware-as-a-Service, Interlock functions as a smaller, specialized team. They develop advanced, proprietary malware, demonstrating high adaptability. Their attacks typically start with a MintLoader infection, often through social engineering tactics labeled “ClickFix,” followed by deploying a JavaScript-based tool called NodeSnakeRAT to move laterally within networks. Once inside, they exfiltrate data using tools like AZcopy before encrypting files, employing a double-extortion tactic that gives them leverage over victims. Moreover, they utilize a custom evasion tool called “Hotta Killer,” which exploits a zero-day vulnerability in a gaming anti-cheat driver, to disable security defenses such as Endpoint Detection and Response (EDR) software. As a result, their attacks can penetrate both Windows and Nutanix hypervisor environments. Because of their ability to swiftly adapt and bypass defenses, organizations worldwide remain vulnerable, prompting calls for enhanced cybersecurity measures. The story is reported by Fortinet analysts, highlighting the group’s sophisticated techniques and the urgent need for vigilance.

Security Implications

The recent emergence of the Interlock ransomware using a new tool to exploit a gaming anti-cheat driver 0-day vulnerability presents a serious threat to all businesses. This tool allows cybercriminals to disable security defenses like endpoint detection and response (EDR) and antivirus (AV) software, which are crucial for protecting sensitive data. As a result, attackers can infiltrate systems more easily, stealing or damaging vital information. Consequently, businesses face a heightened risk of data breaches, operational disruptions, and financial loss. In addition, such attacks can tarnish a company’s reputation and erode customer trust. Therefore, it’s essential for organizations to stay vigilant, update their security measures, and monitor for any signs of threat activity. Failure to do so could leave your business vulnerable to similar sophisticated ransomware attacks.

Possible Remediation Steps

Promptly addressing threats like the ‘Interlock Ransomware Actors New Tool Exploiting Gaming Anti-Cheat Driver 0-Day to Disable EDR and AV’ is crucial to maintaining organizational security and minimizing potential damage. Delays in remediation can lead to widespread data loss, operational downtime, and increased vulnerability to further attacks.

Containment Measures

• Immediately isolate affected systems to prevent lateral movement and limit exposure.
• Disable or disconnect compromised devices from the network until clean.

Detection & Analysis

• Conduct a thorough system scan to identify malicious tools and indicators of compromise.
• Utilize threat intelligence and forensic analysis to understand attack vectors and scope.

Eradication & Recovery

• Remove the malicious anti-cheat driver exploit and any associated malicious files.
• Update and patch all affected systems, especially gaming drivers and security tools.
• Restore systems from secure backups if necessary, ensuring they are clean and up-to-date.

Prevention Strategies

• Implement application whitelisting to restrict unauthorized driver execution.
• Enhance detection capabilities for zero-day exploits through behavioral analysis.
• Regularly update EDR, AV, and all security solutions to address emerging vulnerabilities.

Policy & Training

• Educate staff about this specific threat and safe computing practices.
• Review and strengthen policies related to third-party drivers and gaming applications in enterprise environments.

Explore More Security Insights

Explore career growth and education via Careers & Learning, or dive into Compliance essentials.

Explore engineering-led approaches to digital security at IEEE Cybersecurity.

Disclaimer: The information provided may not always be accurate or up to date. Please do your own research, as the cybersecurity landscape evolves rapidly. Intended for secondary references purposes only.

Cyberattacks-V1cyberattack-v1-multisource