Agencies warn of activity by Interlock ransomware

The FBI, Cybersecurity and Infrastructure Security Agency, Department of Health and Human Services, and Multi-State Information Sharing and Analysis Center July 22 released a joint advisory detailing malicious activity from Interlock ransomware. Activity was first discovered in September 2024 and as recently as June, targeting various organizations and critical infrastructure. The agencies said they are aware of Interlock encryptors designed for Windows and Linux operating systems and have observed cyber actors obtaining access using an uncommon method of drive-by download from compromised legitimate websites, among other tactics. The advisory includes mitigation strategies to help protect against the ransomware.

“Interlock has been directly implicated in high impact ransomware attacks against hospitals and health systems, resulting in the disruption to care delivery and creating a risk to patient and community safety,” said John Riggi, AHA national advisor for cybersecurity and risk. “It remains one of the top ransomware groups targeting health care. Health care organizations are encouraged to pay special attention to this alert, implement the recommended mitigation protocols and load the detailed indicators of compromise into network defenses.” 

For more information on this or other cyber and risk issues, contact Riggi at jriggi@aha.org. For the latest cyber and risk resources and threat intelligence, visit aha.org/cybersecurity.