Ransomware Group ‘Interlock’ Zeroes in on Defense Sector Amid Rising Global Tensions
An aggressive cybercrime syndicate known as Interlock has intensified its infiltration of the defense industrial base, placing military contractors and their logistical networks under direct threat. This shift in targeting strategy marks a dangerous convergence of digital extortion and national security risk.
Emerging in late 2024, Interlock distinguishes itself by prioritizing strategic disruption over mere financial gain. The group uses “big-game hunting” techniques—targeting organizations with maximum leverage potential—and employs a double-extortion model: harvesting sensitive data before initiating file encryption, or increasingly, skipping encryption altogether.
One of the group’s most alarming strikes involved AMTEC Corporation, a U.S. producer of tactical munitions, and its parent company, National Defense Corporation (NDC). Investigators from cybersecurity firm Resecurity uncovered that stolen files—many referencing Department of Defense (DoD) contracts—have surfaced on Interlock’s darknet leak hub, ominously branded as the Worldwide Secrets Blog.
Among the exposed documents are classified references to procurement agreements with top defense contractors including Raytheon and Thales. Technical files such as engineering schematics, deployment timetables, and military-grade shipment routes were among the materials compromised.
A particularly severe breach revealed detailed information from a 2018 DoD contract for M739A1 fuzes, intended for delivery to Yuma Proving Ground. This included personnel contact lists, transport codes, and cargo routing data—information adversaries could use to intercept, delay, or repurpose critical materiel in transit.
Security analysts believe Interlock is operating in the gray zone between cybercriminal enterprise and proxy espionage. Indicators of cooperation with nation-state intelligence services have emerged, suggesting this is more than a financially motivated campaign.
Interlock’s operations also showcase a refined technical playbook. Rather than relying on traditional ransomware payloads, recent attacks lean into stealth: leveraging native Windows utilities in a “Living-off-the-Land” (LotL) approach. Tools like PowerShell and WMI are used to execute scripts, harvest credentials, and maintain persistence without tripping standard defenses.
Initial breach vectors frequently involve impersonation of trusted vendors—particularly logistics providers—or exploitation of supply chain partners with weak security postures.
With its evolving tactics and alignment with geopolitical flashpoints, Interlock represents a sophisticated, asymmetric threat to national defense infrastructure. Its campaigns highlight the critical need for continuous monitoring, zero-trust architecture, and improved resilience across defense-related networks.
Post-Intrusion Tactics: How Interlock Silently Dismantles Endpoint Defenses
According to threat intelligence from Resecurity, once Interlock operators establish a foothold in compromised networks, they initiate a sequence of actions designed to systematically disable host-level security and extract credentials with surgical precision.
In a recent breach affecting an AMTEC-affiliated entity, forensic recovery uncovered a tailored PowerShell payload engineered to neutralize Microsoft Defender protections. This script forcefully halts the WinDefend service, deactivates real-time scanning, and hard-modifies registry keys to suppress antispyware components—an effective method to blind native defenses without raising immediate alarms:
Powershell
Get-Service WinDefend | Stop-Service -Force
Set-MpPreference -DisableRealtimeMonitoring $true
New-ItemProperty -Path “HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender” -Name DisableAntiSpyware -Value 1 -Force
Following this, Interlock’s operators escalate their access using credential extraction techniques. Analysts observed deployment of Mimikatz, a well-known post-exploitation tool, to mine passwords and authentication tokens directly from system memory via lsass.exe. This allows seamless lateral traversal across internal systems, expanding the attackers’ reach and persistence while maintaining stealth.
These attack chains highlight the group’s emphasis on native tool abuse and modular attack strategies—a hallmark of their broader Living-off-the-Land (LotL) methodology.
Interlock: Deep Persistence and Strategic Exfiltration in Defense Sector Breaches
Resecurity’s investigation into the Interlock ransomware group reveals a persistent adversary leveraging a multilayered arsenal of techniques to compromise and maintain control over high-value defense sector targets.
One hallmark of their persistence strategy is the covert deployment of a scheduled task deceptively named “WindowsUpdateSync.” This task launches a Base64-encoded script that quietly initiates communication with a remote command-and-control (C2) node hosted at 212.237.217[.]182. This disguised foothold ensures the attackers can reestablish access even after partial remediation.
Beyond persistence, Interlock demonstrates a sharp tactical edge by exploiting overlooked vulnerabilities in perimeter systems. These include outdated enterprise VPN appliances and legacy Microsoft Exchange servers. In a particularly concerning instance, the group weaponized CVE-2024-21407—a critical flaw in the Windows Kernel—to elevate their privileges to SYSTEM level, effectively granting unrestricted access.
After successful exploitation, the exfiltration phase begins. Rather than using easily flagged outbound connections, the attackers leverage encrypted channels—specifically TLS tunnels—to discreetly transfer stolen data to cloud-based storage services like Mega.nz. This technique allows Interlock to bypass conventional monitoring tools that are blind to encrypted payloads and miscategorized cloud traffic.
Recent breaches have exposed sensitive logistics records tied to international defense entities, including documentation allegedly connected to Turkmenistan’s Ministry of Defense. The strategic implications of such leaks are profound—undermining operational secrecy and potentially shifting regional balances of power.
Despite federal mandates such as the Cybersecurity Maturity Model Certification (CMMC)—designed to harden U.S. defense supply chain security—many contractors remain ill-prepared, lacking adequate incident response protocols and access control enforcement.
Resecurity recommends immediate action across three key fronts:
- Restrict and audit third-party access across supply chains, adopting a Zero Trust architecture to limit lateral movement.
- Continuously monitor for PowerShell, WMI, and credential dumping tools—hallmarks of advanced persistent threats (APTs).
- Immediately patch systems vulnerable to CVE-2024-21407 and related privilege escalation flaws.
As Interlock continues targeting the defense ecosystem, the need for proactive, threat-informed defense has never been more urgent.
