Interlock Ransomware Weaponizes Forensic Tools for Credential Theft — 26 Hours From Endpoint to Domain Compromise

Interlock, tracked by Sophos as GOLD EMBRACE, ran a March 2026 intrusion in which the group used two tools that belong to the defender's own kit, the WinPmem memory acquisition utility and Volatility3's hashdump and cachedump modules, to pull NTLM hashes and cached domain credentials from an unprotected Windows 10 endpoint. Initial access came from a ClickFix lure on a compromised website the victim reached while searching for Dynamics 365 guidance. From that single machine the actor reached the domain controller within 26 hours using LDAP enumeration, Kerberoasting, and an anonymous-login NTLM downgrade, then created a scheduled task masquerading as Windows Defrag to run node.exe payloads, stole AWS credentials, tampered with Defender, and locked out the victim's hypervisors. Sophos separately ties Interlock to exploitation of the Cisco FMC zero-day CVE-2026-20131 roughly two weeks before Cisco publicly acknowledged it.

The mechanism matters because it inverts the usual trust model: WinPmem and Volatility3 are signed, legitimate forensics binaries that endpoint tooling tends to tolerate, and here they ran on a host with no protection at all, so the credential theft itself generated no endpoint telemetry. What remains for the defender is the domain tier. Kerberoast ticket requests and LDAP enumeration bursts against the domain controller are the artifacts that survive once memory has been acquired and the workstation is no longer trustworthy as a source of truth. The 26-hour figure is the real exposure window: an organization that still measures incident response in days will have its domain compromised before the first ticket is triaged. The CVE-2026-20131 timing compounds this, because it shows this group treating vendor advisories as lagging indicators, exploiting roughly two weeks ahead of the public disclosure many teams patch against.

Defender actions follow from the artifacts. Close the coverage gap first, since one unprotected Windows 10 machine was the pivot for the whole intrusion, and verify EDR on every endpoint rather than by console percentage. Hunt for WinPmem driver loads and Volatility3 invocations outside your own IR workflow, and for scheduled tasks named to resemble Windows Defrag that launch node.exe, which was this actor's persistence pattern. On the domain tier, alert on spikes in RC4-encrypted service ticket requests and on anomalous LDAP query volume, and restrict NTLM with anonymous logins disabled to kill the downgrade path used here. Audit Cisco FMC estate for CVE-2026-20131 patch status and treat any FMC instance that was exposed before the advisory as potentially compromised rather than merely unpatched. Rotate the AWS credential inventory and confirm via access logs that no cloud-side use followed the theft seen in this case. Finally, rehearse backup restores, because the victim believed backups existed yet still had to rebuild its virtual environment and migrate Active Directory to Entra ID.

Two developments would change this assessment. If Cisco escalates CVE-2026-20131 from acknowledgment to confirmed broader exploitation, every FMC operator moves from scheduled patching to emergency verification of compromise. And if further IR writeups show other ransomware crews adopting memory-acquisition utilities for initial credential theft rather than post-exploitation triage, the endpoint blind spot described here stops being an Interlock quirk and becomes a pattern that shifts mandatory detection investment to the domain tier.