Interlock Ransomware Adopts FileFix Method to Deliver Malware

Interlock ransomware adopts FileFix method to deliver malware

Hackers have adopted the new technique called 'FileFix' in Interlock ransomware attacks to drop a remote access trojan (RAT) on targeted systems.

New PHP-Based Interlock RAT Variant Uses FileFix Delivery Mechanism To Target Multiple Industries - Cybernoz - Cybersecurity News

Jul 14, 2025Ravie LakshmananMalware / Web Security Threat actors behind the Interlock ransomware group have unleashed a new PHP variant of its bespoke remote access trojan (RAT) as part of a widespread campaign using a variant of ClickFix called FileFix. “Since May 2025, activity related to the Interlock RAT has been observed in connection with the LandUpdate808 (aka KongTuke) web-inject threat clusters,” The DFIR Report said in a technical a…

Interlock ransomware adopts FileFix method to deliver malware | #ransomware | #cybercrime - National Cyber Security Consulting

Hackers have adopted the new technique called 'FileFix' in Interlock ransomware attacks to drop a remote access trojan (RAT) on targeted systems. Interlock ransomware operations have increased over the past months as the threat actor started using the KongTuke web injector (aka 'LandUpdate808') to deliver payloads through compromised websites. This shift in modus operandi was observed by researchers […] Thank you for subscribing to our RSS feed!…

New PHP-Based Interlock RAT Variant Uses FileFix Delivery Mechanism to Target Multiple Industries

Threat actors behind the Interlock ransomware group have unleashed a new PHP variant of its bespoke remote access trojan (RAT) as part of a widespread campaign using a variant of ClickFix called FileFix. "Since May 2025, activity related to the Interlock RAT has been observed in connection with the LandUpdate808 (aka KongTuke) web-inject threat clusters," The DFIR Report said in a technical

KongTuke Campaign Deploys Modified Interlock RAT Using FileFix Method Against Windows Environments

Researchers from The DFIR Report, collaborating with Proofpoint, have uncovered a resilient PHP-based variant of the Interlock ransomware group’s remote access trojan (RAT), marking a significant evolution from the previously documented JavaScript-driven NodeSnake. This adaptation, observed in campaigns linked to the LandUpdate808 threat cluster also known as KongTuke has been active since May 2025, exploiting […] The post KongTuke Campaign Depl…