Interlock

☆ pin

Also known as Hive0163, TAG-124, KongTuke, Landupdate808, GOLD EMBRACE

Reports

First seen

Jul 14, 2025

Last seen

Oct 12, 2026

Motivation

Financial

Relationships

Filled ◆ = CVE exploited in the wild. Entities that appear together in Signalis reporting — co-mention, not confirmed collaboration. Reports naming many actors at once (weekly roundups) are excluded from relationship edges.

Targeting

Sectors

Healthcare ×10 Education ×4 Manufacturing ×4 Other ×2 Retail & E-commerce ×2 Hospitality ×1 Government ×1 Professional Services ×1

Victim regions

×1

×16

United States×16

Canada×2

Australia×1

Victim country, only when stated. Corpus is predominantly English-language reporting, so US/EU coverage is overweighted relative to true victim distribution.

Top ATT&CK techniques

T1566 Phishing ×4T1486 Data Encrypted for Impact ×3T1059 Command and Scripting Interpreter ×3T1021 Remote Services ×3T1003 OS Credential Dumping ×2T1041 Exfiltration Over C2 Channel ×2T1195 Supply Chain Compromise ×2T1566.002 Phishing: Spearphishing Link ×2T1547 Boot or Logon Autostart Execution ×2T1189 Drive-by Compromise ×1T1053.005 Scheduled Task/Job: Scheduled Task ×1T1192 Spearphishing Link ×1

Indicators

domain ×69cve ×18filename ×17ip_v4 ×17hash_sha256 ×8url ×3hash_sha1 ×2hash_md5 ×2registry_key ×1

Indicator values are available on Pro and via the API.

Associated CVEs

CVE-2026-20131 (exploited)CVE-2022-25478 CVE-2022-25479 CVE-2022-25480 CVE-2024-40431 CVE-2024-40432 CVE-2025-21079 (exploited)CVE-2025-49760 CVE-2025-58486 (exploited)CVE-2025-59200 CVE-2025-7850 (exploited)CVE-2025-7851 (exploited)CVE-2026-25177 CVE-2026-27912 CVE-2022-25477 CVE-2026-9181

Recent reports

High

Interlock

Relationships

Targeting

Top ATT&CK techniques

Indicators

Associated CVEs

Recent reports

Interlock publishes Pedigo Products, Inc. as ransomware victim

Interlock ransomware gang claims Valenti Management breach

Interlock publishes Concord Eye Center as ransomware victim

Interlock publishes Greentech Environmental as ransomware victim

Interlock ransomware: Engineers Contractors Fabricators Inc. victim published

Interlock publishes Nu-Quest Distribution Inc as ransomware victim

Interlock ransomware gang publishes Shalom Christian Academy breach

Interlock publishes Riviera Healthcare Center as ransomware victim

Interlock ransomware group claims H&L Manufacturing victim

Interlock ransomware gang publishes O2 Dental Group as victim

Interlock publishes Blaise C. Bender, PC law firm as ransomware victim

Interlock ransomware publishes Tekko Enterprises as victim

Interlock ransomware gang publishes Center for Kidney Care as victim

Interlock ransomware claims NFM Lending as new victim

Interlock ransomware gang publishes Super Systems Inc as victim

Interlock ransomware gang claims Southeastern Oklahoma State University breach

Interlock publishes Connell Enterprises LLC victim claim on ransomware.live

Interlock ransomware claims AngMar Companies victim, 710 GB data exfiltrated

ThreatsDay: 30 Weekly Threat Roundup—RCE, Device Takeovers, Supply Chain, AI Abuse

Interlock Ransomware Abuses Volatility3 Memory Analysis Tool in March 2026 Incident

Interlock ransomware gang publishes Gardiner Family Chiropractic as victim

Interlock publishes Centre for Newcomers victim data

Interlock ransomware gang publishes Paragon Store Fixtures as victim

Interlock ransomware claims compromise of District of Columbia Housing Authority

Interlock ransomware gang publishes Converting Equipment International as victim

Interlock ransomware claims Borger ISD breach, 330 GB data published

ThreatsDay: Cloud Bucket Hijacking, Windows LPE Chain, Global Fraud Bust + 17 More Stories

Interlock claims YMCA of Western North Carolina in ransomware attack

Interlock ransomware claims Clearview Eye Centre as victim

Interlock publishes Reynella East College data breach