# What is Interlock ransomware?

Interlock is a ransomware operation first observed in September 2024, targeting businesses and critical infrastructure in North America and Europe. CISA, the FBI, the US health department and the MS-ISAC described it in joint advisory AA25-203A of 22 July 2025. Unlike many groups, Interlock often gets in through drive-by downloads from compromised legitimate websites, including fake browser updates, and through the ClickFix technique, in which a fake CAPTCHA or error prompt persuades the user to paste and run a command. It uses double extortion and encrypts both ordinary computers and virtual machines. The advisory's recommended defences reflect that entry route: DNS and web filtering to block malicious sites, up-to-date browsers and endpoint protection, and staff who know that no real website asks them to paste commands, plus the usual patching, MFA and network segmentation. After the initial access, the remote-control traffic and the lateral movement are the stages network monitoring can see.

FAQ: [Ransomware groups and families](https://netsenx.com/en/faq/ransomware-families) · https://netsenx.com/en/faq/what-is-interlock-ransomware

## Read next

- https://netsenx.com/en/detect-ransomware-on-the-network
- https://netsenx.com/en/blog/2026-10-24_ransomware-protection

## Related questions

- [What is the difference between a ransomware family, a group and an affiliate?](https://netsenx.com/en/faq/difference-between-a-ransomware-family-group-and-affiliate)
- [What is ransomware as a service (RaaS)?](https://netsenx.com/en/faq/what-is-ransomware-as-a-service)
- [What is double extortion in ransomware?](https://netsenx.com/en/faq/what-is-double-extortion-ransomware)
- [What is a ransomware leak site?](https://netsenx.com/en/faq/what-is-a-ransomware-leak-site)
- [Where can we find official information about ransomware groups?](https://netsenx.com/en/faq/where-to-find-official-ransomware-advisories)