The joint advisory AA25-203A, published 22 July 2025 with HHS as a co-author, says Interlock actors gain access through drive-by downloads from compromised sites, fake browser or security software updates, and ClickFix prompts that trick users into running a pasted PowerShell command. The advisory does not describe specific healthcare victims.
Who is targeted
The advisory says Interlock has hit businesses and critical infrastructure in North America and Europe since September 2024, and that the actors are opportunistic and financially motivated. HHS co-authorship is why it points healthcare and public health organizations to sector guidance.
The three entry techniques
Drive-by downloads. A user visits a legitimate site that has been compromised and receives a payload. The advisory calls this unusual for ransomware groups.
Fake updates. Pages offer a Chrome or Edge update, and more recently updates for security software such as FortiClient, GlobalProtect and Cisco Secure Client.
ClickFix. A fake CAPTCHA tells the user to press keys that paste and run a Base64 encoded PowerShell command. The user executes the attack themselves.
What happens next
The advisory describes persistence through startup files and a registry run key named Chrome Updater, command and control tools, credential theft by info stealers, and lateral movement through remote desktop and remote access tools. Data is taken before encryption, then victims are told to contact the group through a Tor address, with no ransom amount in the note.
Controls the advisory recommends
- DNS filtering and web access firewalls to block malicious sites.
- Patch priority for known exploited vulnerabilities on internet facing systems.
- MFA, strong passwords following NIST guidance, and least privilege including time limited admin access.
- EDR on virtual machines as well as endpoints.
- Network segmentation, and restricting command line and scripting use.
- Offline, encrypted, immutable backups with tested restores.
Training that fits the attacks
Tell staff two things. Software updates arrive through managed channels, never from a web page. And no legitimate site asks you to paste a command into a window. Show them a ClickFix screenshot, because recognition is faster than rules.
Restricting who can run PowerShell is a strong technical backstop, since the user step then fails.
Safeguard covers dependency and vulnerability work, not endpoint detection, so use it alongside your endpoint and email tooling.
A short response drill
Simulate a report from an employee who ran a pasted command. Who do they call, how quickly is the device isolated, and who checks for new startup entries and stolen browser sessions? Time it. The advisory's persistence details, such as startup folder files and a registry run key, give your responders concrete things to look for in that first hour.
Try it yourself
Click a finding that has a fix and see how quickly a known exploited issue could be closed.
Click through it at your own pace, or open it full screen.
Quick check
What is ClickFix?
A fake CAPTCHA or error that instructs the user to paste and run a command, so the user launches the malware.
Does the advisory say Interlock targets hospitals?
It does not describe healthcare victims. It lists wide sector targeting and points health organizations to HHS guidance.
Sources
Last reviewed: 19 October 2026.
