Interlock and Rhysida Ransomware Groups Share Supper Backdoor

Key Takeaways

• New research from IBM X-Force establishes a strong operational and development link between the Interlock and Rhysida ransomware groups.
• Both notorious ransomware operations utilize a shared backdoor known as Supper (also called SocksShell or WINDYTWIST) and share core malware codebase elements.
• The groups primarily target organizations in the United States across healthcare, education, and government sectors, often gaining initial access through trojanized software installers.
• Organizations should implement robust endpoint detection, monitor for anomalous executables, and be wary of fake browser update prompts to mitigate risks.

A recent in-depth investigation has uncovered compelling evidence suggesting a significant connection between two active and destructive ransomware groups, Interlock and Rhysida. The findings indicate that these threat actors not only share a common backdoor, dubbed Supper, but also deploy distinct malware tools derived from a shared underlying codebase. This points to either a collaborative development effort or a direct exchange of tools and expertise between the groups.

Analysts at IBM X-Force detailed their two-year investigation in a comprehensive report, revealing the previously unacknowledged links. The Interlock group, internally tracked as Hive0163, initiated its ransomware campaigns in September 2024. Unlike many ransomware-as-a-service (RaaS) operations, Interlock exclusively uses its proprietary toolkit, which includes NodeSnake, InterlockRAT, and the JunkFiction downloader. Conversely, Rhysida, active since at least May 2023, operates as a RaaS platform, making its tools available to affiliates.

By the close of 2025, both groups had claimed approximately 80 victims each, with the majority located within the United States. Sectors most heavily impacted included healthcare, education, and government.

Interlock and Rhysida Ransomware Operations

The shared use of the Supper backdoor, also identified as SocksShell or WINDYTWIST, represents the most explicit overlap between Interlock and Rhysida. This backdoor has been observed in confirmed incidents attributed to both ransomware operations. Supper, first detected in July 2024, predates Interlock’s NodeSnake and InterlockRAT, and was initially found protected by the JunkFiction crypter, a tool also employed by Interlock for its own malware.

Supper provides persistent access to compromised systems, establishes encrypted communication tunnels, and executes remote shell commands. These capabilities closely mirror those of InterlockRAT, highlighting a functional convergence. IBM X-Force’s analysis further revealed that InterlockRAT and Supper exhibit nearly identical command structures, use similar formats for registering with command-and-control (C2) servers, and employ the same self-deletion mechanism. Specifically, a DLL component embedded in older Supper versions for disk erasure is precisely the same component found within the Interlock ransomware binary, activated when the ransomware is instructed to self-destruct after file encryption.

Further strengthening the theory of shared development, NodeSnake, commonly the initial loader in Interlock infections, shares code logic and C2 server addresses with both the JunkFiction downloader and InterlockRAT. Additionally, a newer Python-based backdoor known as ModeloRAT, deployed by the TAG-124 traffic distribution network associated with Interlock, extends NodeSnake’s code structure and utilizes identical network validation bytes. These extensive overlaps strongly suggest that the malware tools for both groups originated from the same developers.

Attack Chains, Infection Tactics, and Toolset

Both Interlock and Rhysida frequently leverage trojanized software installers as their primary method for initial compromise. They create deceptive download pages for popular applications, such as Microsoft Teams, to trick unsuspecting users into executing malicious files. These installers are often signed with fraudulent code-signing certificates acquired from cybercrime forums, allowing them to bypass standard security checks on many systems.

Once initial access is established, attackers utilize sophisticated traffic distribution systems to redirect victims and deliver payloads through “ClickFix-style” attacks or fake browser updates. Interlock has consistently been linked to the TAG-124 system, also known as LandUpdate808. Rhysida actors, operating under the “Vanilla Tempest” cluster, have been observed using Gootloader-based access that subsequently deploys Supper before the final ransomware payload.

Post-compromise activities are characterized by thorough and systematic network traversal. Attackers employ various legitimate and malicious tools, including AZcopy for data exfiltration, Advanced Port Scanner for network reconnaissance, and credential stealers to escalate privileges. IBM X-Force also discovered a custom Windows Defender Application Control (WDAC) policy on Interlock staging servers. This policy was designed to disable Windows Defender and other endpoint security tools while allowing the group’s own malware to operate unimpeded.

What You Should Do

• Enhance Endpoint Security: Deploy and maintain robust Endpoint Detection and Response (EDR) solutions capable of detecting anomalous executables and behavior.
• Implement Application Control: Utilize application whitelisting or strong application control policies to prevent the execution of unauthorized software, especially those signed with suspicious or newly encountered certificates.
• User Awareness Training: Educate employees about the dangers of downloading software from unofficial sources, recognizing phishing attempts, and identifying fake browser update prompts.
• Monitor Network Traffic: Continuously monitor network traffic for unusual C2 communications and the use of remote management software in unexpected contexts.
• Regular Backups: Maintain isolated, encrypted backups of critical data to ensure recovery in the event of a ransomware attack.
• Review and Update WDAC Policies: Regularly review and harden Windows Defender Application Control policies to prevent adversaries from disabling security features.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.