Interlock Turns the Tools Incident Responders Use Into Weapons for Stealing Windows Passwords

Interlock Turns the Tools Incident Responders Use Into Weapons for Stealing Windows Passwords

Interlock ransomware is taking a familiar Windows security tool and using it for credential theft. The group has turned memory analysis software into a way to pull password hashes and account data from compromised computers. One compromised workstation became a launch point for a wider breach. ClickFix gave attackers access; they persisted, raised privileges, reached a domain controller, stole data, and locked the victim out of hypervisors. Soph…