As cited
Copy frozen at (site build).
ransomware
KongTuke FileFix Leads to New Interlock RAT Variant
Researchers from The DFIR Report and Proofpoint have identified a new PHP-based variant of the Interlock ransomware group's remote access trojan (RAT), marking a shift from the group's previous JavaScript-based implementation known as NodeSnake. The new variant has been observed in active campaigns since May 2025 and represents an evolution in the group's malware toolkit.
Why it matters: Organizations should monitor for Interlock RAT activity and implement detection rules for the new PHP variant, as the group continues to refine its tools and deploy them in widespread campaigns targeting potential victims.
- Source published
- First seen by Cybersecurity Tracker