Interlock ransomware operators have been observed abusing legitimate forensic tools, Volatility3 and WinPmem, to collect Windows memory and extract credentials from compromised systems.
The activity was identified by Sophos Emergency Incident Response during a March 2026 investigation involving a Windows 10 endpoint.
Sophos tracks Interlock as GOLD EMBRACE, a ransomware group active since September 2024. The group primarily targets organizations in North America and Europe, including critical infrastructure, healthcare, and education entities.
Interlock uses double extortion tactics, stealing sensitive data before encrypting systems and threatening victims with public leaks through its “Worldwide Secrets Blog.”
Unlike many ransomware operations, Interlock does not appear to operate a ransomware-as-a-service model.
Instead, it is believed to be a smaller and dedicated group that develops its own malware, carries out intrusions, steals data, and deploys ransomware.
The group has previously used ClickFix social-engineering lures, the NodeSnake or Interlock RAT remote-access trojan, and PHP-based backdoors.
It has also been linked to exploitation of CVE-2026-20131, a critical zero-day vulnerability affecting Cisco Secure Firewall Management Center software.
Interlock Dumps Windows Credentials
In the incident, Interlock used Volatility3, an open-source memory forensics framework normally used by incident responders and malware analysts. On the initial compromised endpoint, the attackers executed the following command:
vol.exe -f .\mem.raw windows.hashdump.Hashdump
This command attempts to recover NTLM hashes, legacy LM hashes where available, and local user account information from a Windows memory image.
NTLM hashes are particularly valuable to attackers because they can support password cracking or pass-the-hash attacks against other systems.
The operators also ran:
vol.exe -f .\mem.raw windows.cachedump.Cachedump
This module extracts cached domain credentials, including usernames and password-hash data related to users who previously logged into the device.
Such data can help attackers identify domain accounts and prepare for lateral movement.
Before analyzing the memory image, Interlock used WinPmem, a legitimate physical-memory acquisition tool, to capture RAM from the endpoint:
winpmem_mini_x64_rc2.exe mem.raw
The use of trusted tools can make malicious activity harder to identify. Volatility3 and WinPmem are widely used in digital forensics and incident response, so their presence alone does not prove an attack.
However, organizations should investigate their use when no approved forensic activity is underway.
The intrusion began with a ClickFix-style lure. An employee searching ChatGPT for Dynamics 365 was redirected to a legitimate website believed to have been compromised.
The site displayed a lure designed to convince the user to copy and paste a malicious command into the Windows Run dialog, sophos said.
Within seconds, the attackers accessed clipboard data and persuaded the user to execute the command.
The command downloaded PowerShell code from afshapiro[.]com, retrieved a remote-access trojan from 104.236.109[.]139, and established persistence. The PowerShell execution used wildcard path matching to reduce the chance of detection.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN. Gain complete phishing visibility to strengthen your SOC and reduce MTTR
