Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
3 IOCs
Interlock Ransomware Abuses Volatility3 and WinPmem to Dump Windows Credentials From Memory
Excerpt
Interlock ransomware operators have been observed abusing legitimate forensic tools, Volatility3 and WinPmem, to collect Windows memory and extract credentials from compromised systems. The activity was identified by Sophos Emergency Incident Response during a March 2026 investigation involving a Windows 10 endpoint. Sophos tracks Interlock as GOLD EMBRACE, a ransomware group active since September 2024. The group primarily targets organizations in North America and Europe,…
Read the original report →Diamond Model
Adversary
Infrastructure(2)
Capability
Victim
Indicators of Compromise
Open the mindmap →3 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| IP | 104.236.109.139 | Medium | Score 50/100 | First seen |
| CVE | CVE-2026-20131 | High | Score 60/100 | First seen |
| Domain | afshapiro.com | High | Score 77/100 | First seen |
IOC Relationship Graph
Building graph…