Interlock Ransomware Recovery: What's Recoverable

Interlock was first observed in September 2024. Its leak site had listed 129 victims by 1 October 2026, 99 of them in the United States, with Canada, the UK and Australia next (ransomware.live). Education is the most-hit sector, followed by manufacturing, professional services, government and healthcare. CISA and the FBI issued a joint advisory on the group in July 2025.

Interlock's entry route is unusual for ransomware. Instead of buying access or exploiting a VPN, it has relied on drive-by downloads from legitimate websites that were compromised, presenting a fake browser or security-software update. It also uses the technique known as ClickFix: a fake verification or error page tells the visitor to press a key combination and paste a command, which runs a malicious PowerShell script.

From that first machine the attackers install remote-access tools, steal credentials, move across the network and copy data out. Encryption comes last. Encryptors exist for both Windows and Linux, and virtual machines are a main target. Affected files typically carry the .interlock extension, and the ransom note gives a code and a Tor address rather than a price.

The advisory describes a combination of AES and RSA encryption, and no flaw has been published that would allow decryption without the attackers' key. Recovery therefore comes from what the attack did not reach or did not finish: backups on storage the attackers could not get to, hypervisor or array snapshots that survived, and virtual disks and database files that were only partly processed.

Because the attack usually begins on an ordinary user's computer, the first infected machine is often not a server. Keeping that machine untouched matters: it shows when the attackers got in, which tells you which backups predate them.

Every one of those options depends on the affected storage being imaged before anything is rebuilt, reinstalled or "cleaned". That first step is what keeps the rest possible.