InterlockRAT
InterlockRAT is a backdoor associated with the Interlock ransomware operation, which IBM X-Force tracks under the financially motivated cluster Hive0163. It is deployed in multi-stage intrusions that commonly begin with ClickFix social-engineering lures and malicious PowerShell execution, with NodeSnake frequently serving as the first-stage loader before InterlockRAT is delivered. In observed attacks, InterlockRAT was used alongside other malware components including NodeSnake and the PowerShell backdoor Slopoly, culminating in deployment of the Interlock ransomware payload.
Its documented capabilities include remote command execution, reverse shell access, SOCKS5 tunneling, and web socket communication. IBM X-Force reported that InterlockRAT and the Supper backdoor share nearly identical command structures, similar command-and-control registration formats, and the same self-deletion method, indicating strong tooling overlap. Additional reporting noted code logic and infrastructure overlap between NodeSnake, JunkFiction, and InterlockRAT, and IBM assessed these overlaps strongly suggest common developers or a trusted code-sharing arrangement. InterlockRAT is part of a broader malware ecosystem linked to Interlock and, by IBM’s assessment, connected to tooling also used around Rhysida operations.
The malware has been observed in ransomware intrusions affecting primarily U.S.-based victims, with healthcare, education, and government among the most affected sectors in 2025 according to IBM X-Force’s broader reporting on Interlock activity. High-confidence indicators directly mentioned in the content include its association with Hive0163/Interlock operations and its role as a later-stage backdoor delivered after NodeSnake in ClickFix-driven compromises.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The more capable InterlockRAT followed, adding web socket communication, a SOCKS5 tunnel, and a reverse shell.
Techniques & procedures
6 distinct techniques documented for this family, organized by ATT&CK tactic.
Command and Control
6 techniques
Command and Control
Once inside a system, threat actors deploy Slopoly as a PowerShell script, functioning as a client for a command-and-control (C2) framework.
The more capable InterlockRAT followed, adding web socket communication, a SOCKS5 tunnel, and a reverse shell.
NodeSnake downloaded additional payloads, including the more advanced InterlockRAT, which enables reverse shells, SOCKS5 tunneling, and remote command execution.
NodeSnake downloaded additional payloads, including the more advanced InterlockRAT, which enables reverse shells, SOCKS5 tunneling, and remote command execution.
IOCs tracked for this family
6 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
Recent activity
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A remote access trojan/backdoor in Interlock’s custom toolkit. It closely mirrors Supper in internal behavior, including command structure, C2 registration, and self-deletion logic.
Remote access trojan used in the attack chain to provide more advanced post-compromise capabilities, including WebSocket communications, SOCKS5 tunneling, and reverse shell access.
Remote access trojan/backdoor used alongside Slopoly and NodeSnake in attack chains that culminate in Interlock ransomware deployment.
More advanced payload in the Hive0163 C2 framework that provides reverse shells, SOCKS5 tunneling, and remote command execution.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.