First appearing in September 2024, Interlock is a sophisticated ransomware operation that blends espionage-style tactics with aggressive double extortion.
Victims of Interlock typically experience complete network disruption, coupled with threats to leak sensitive files if the ransom is not paid. The group is known for its precise, stealthy intrusions and high-pressure tactics, making it a dangerous adversary for mid-sized and large enterprises alike.
If you discover a physical break-in at your offices, your first instinct would be to call the police and touch nothing - understanding the need for a forensic investigation. A cyber-attack requires the same approach.
Your digital environment is a CRIME SCENE. It is crucial to leave the environment untouched to allow for a forensic investigation.
This is not a task for your IT team or MSP. Digital Forensic specialists available 24/7 to assist you, just like in a physical crime.
Interlock is an advanced ransomware threat actor suspected to be run by a tightly coordinated, highly skilled group of cybercriminals. While no formal ties have been confirmed, some researchers believe Interlock may be operated by former affiliates of well-known ransomware gangs such as Conti or Royal, based on similarities in payload structure, encryption routines, and communication methods.
What distinguishes Interlock from many other groups is its hybrid approach: it combines traditional ransomware techniques with advanced persistent threat (APT)-style tactics. The group doesn’t just encrypt data - it performs deep reconnaissance, steals credentials, disables security solutions, and exfiltrates sensitive documents well before any encryption begins.
Interlock predominantly targets organisations in finance, professional services, critical infrastructure, and national supply chains - industries where both operational disruption and data leakage pose severe business and regulatory risks. It is also one of the few new ransomware operations to include legal threats within their ransom notes, warning victims of potential GDPR fines and public disclosure if payment is not received.
Ransom demands can range from £250,000 to over £5 million, depending on the scale of the target and the sensitivity of the stolen data. Victims are directed to a Tor-based portal where negotiation, decryption testing, and payment instructions are handled.
Interlock attacks unfold over days and weeks, starting with spear-phishing, exploited vulnerabilities, or stolen credentials. Once inside, attackers conduct stealthy reconnaissance using legitimate tools to map the network, escalate privileges, and identify backups and sensitive data.
They often disable EDR systems and deploy infostealers or keyloggers before exfiltrating data. Only then do they launch encryption, using AES-256 and appending extensions like .interlocked. Ransom notes warn of data leaks and reputational damage.
In advanced cases, Interlock has used DDoS attacks and leaked stolen data to media or business partners to intensify pressure on victims.
Interlock first emerged in September 2024 and has been linked to 53 confirmed ransomware incidents globally, with most victims located in Europe and North America. As of mid-2025, Interlock’s operational tempo continues to increase, and it is considered an emerging but significant threat in the ransomware landscape.
Solace Cyber’s track record includes hundreds of successful response recoveries, providing Digital Forensic Incident Response services, 24x7x365.
“Global ransomware payments in 2023 topped $1 billion”
Solace Global was founded in 2010 as global experts in risk management and security, offering services such as Travel, Crisis, and Offshore Risk Management. With a 24/7 Security Operations Centre and an in-house intelligence team providing daily and weekly reports, Solace Global is accredited to ISO 27001, 14001, 45001, and 9001 standards.
Solace Cyber was established in 2021, specialising in Cyber breaches, particularly Digital Forensics and Incident Response, Ransomware, Risk Management, and Information Security, along with Managed Security Services. The leadership team collectively possess over 20 years of experience in the IT and security industry. Solace Cyber is accredited to ISO 27001.
s
%+
A forensic analysis needs to be meticulous and a clean restore and recovery requires a wealth of experience not normally available in an in-house team who must provide a broader range of IT support skills:
Solace Cyber was established precisely for this scenario. We have a well-defined process for handling cyber-attacks like Interlock, which involves a 6-step approach:
It includes a thorough digital forensic analysis from step 2 where the output becomes a central component of business recovery. This is because understanding the attack is of critical importance:
It is critical that the analysis of digital evidence is carried out to an agreed plan. This will have been designed to provide the best and earliest chance of discovering a root cause, which is essential to inform remediation/eradication and recovery as well as supporting a legal take-down case if this is applicable. A legal take-down means we can assist in the legal enforcement that stops the criminals from publishing the data, thus undermining the ransom notice.
Solace’s Digital Forensic and Incident Response teams maintain consistent communication throughout. Dedicated Incident Managers and technical engineering leads provide updates during the Cyber Incident Response journey, utilising risk registers and working within change management processes, all from triage through to post-incident, delivering successful business recovery.
Solace Cyber's assistance extends beyond the recovery phase. Following the restoration of your business operations, we collaborate with you to enhance your cyber security posture using a threat-informed methodology. This involves leveraging our Cyber 9 Step Process, designed to comprehensively address cyber threats and vulnerabilities.
Interlock utilise a Ransomware‑as‑a‑Service (RaaS). Unlike fully in‑house malware, Interlock operates via affiliates using customised payloads, negotiation portals, and a dedicated leak site called "Worldwide Secrets Blog".
The Interlock ransomware entered your system by one of several ways:
We recommend you adopt policies to:
After recovering from a Interlock ransom attack, Solace Cyber recommends that you update your business continuity plan to account for lessons learnt during this attack & recovery.
Most ransomware breaches cost approximately £500K, while smaller email data breaches typically cost around £50K. There is a critical balance between preserving the environment for forensic analysis and quickly recovering it to minimise business interruption. The costs increase the longer it takes to identify and resolve the breach.
A cyber security insurance claim is complex, covering reasonable expenses for investigating and remediating an incident, along with legal fees, business interruption, criminal liability, employment liability, and ransom payments. Although the insurance industry is responsible for facilitating business recovery, cyber insurance is viewed as volatile, and many policies are not being validated correctly.
Finding your way through demands expertise, and that's where Solace Cyber can offer assistance.
Facing genuine pressure, there's a crucial decision to make - one that could rescue your organisation from weeks of operational standstill, reputation damage, and client data loss. Yet, the probability of a favourable outcome remains slim, emphasising the importance of engaging a specialised ransomware incident response team. They are your most viable recourse for navigating a ransomware incident.
The NCSC have documented the deliberations for paying ransomware: https://www.ncsc.gov.uk/ransomware/home
Important Reminder: It is a criminal offense to pay money to people who are subject to financial sanctions. The list of who is subject to financial sanctions is constantly changing.
The latest iteration can be found here: https://www.gov.uk/government/publications/financial-sanctions-consolidated-list-of-targets
Yes. There's a possibility that some of the lost data falls under the category of "Personal Data" belonging to your customers. It's your legal responsibility to safeguard this data, even if it has been lost. Additionally, you may need to notify the Information Commissioner's Office at https://ico.org.uk/.
Your insurer or legal counsel will provide guidance on the necessary steps and how to move forward in this situation.
Solace has experience collaborating with insurers and legal professionals and can offer support in managing this relationship during this challenging period.
A ransomware attack presents the most significant threat to your business by:
In the event of a business interruption, determining your position in the supply chain for any item and sustaining operations become challenges. If the disruption persists, maintaining business continuity becomes paramount. Moreover, upon restoration of systems and data, addressing any backlog of work and establishing operational protocols for the future becomes essential.
Ransomware ranks only behind receivership in terms of its capacity to incapacitate a business.
Action Fraud is the UK’s national reporting centre for fraud and cybercrime. Whether you have been scammed, defrauded, or experienced cybercrime in England, Wales, or Northern Ireland, Action Fraud offers a central point of contact for information on fraud and financially motivated cybercrime.
In the event of a Interlock ransom attack on your systems, REMAIN CALM.
DO NOT INTERACT WITH THEM, ATTEMPT TO RESTORE, OR OVERWRITE ANY DATA (explanation above).
Reach out to Solace Cyber at 01202 308818 or complete our form for a callback from one of our specialists.
We'll respond promptly to minimise your business's downtime.
Solace Cyber, part of Solace Global, helps companies across the UK recover from ransomware attacks and data breaches.
SOLACE GLOBAL CYBER LTD is registered in England & Wales no. 08830710
Solace Global
Twin Sails House,
W Quay Rd,
Poole, BH15 1JF
United Kingdom
