The Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) have raised an alarm over an increase in ransomware activity linked to the Interlock gang. The advisory, released on Tuesday in collaboration with the Department of Health and Human Services (HHS) and the Multi-State Information Sharing and Analysis Center (MS-ISAC), warns that the group is actively targeting businesses and critical infrastructure in double extortion attacks.

The alert includes indicators of compromise (IOCs) gathered from recent investigations—some as recent as June 2025—and outlines protective measures for network defenders.

Emerging in September 2024, Interlock is a relatively new but rapidly growing ransomware operation. It has launched attacks across various global sectors, with a particular focus on healthcare. The gang has previously been connected to ClickFix intrusions, where they impersonated IT utilities to breach networks, and to malware campaigns using a remote access trojan (RAT) known as NodeSnake, particularly affecting U.K. universities.

The group recently claimed responsibility for cyberattacks on DaVita, a Fortune 500 kidney care company, leaking 1.5 terabytes of stolen data, and Kettering Health, a major healthcare provider with over 120 outpatient locations and more than 15,000 employees.

According to the FBI, the Interlock gang has been observed using unusual methods to infiltrate systems.

"FBI observed actors obtaining initial access via drive-by download from compromised legitimate websites, which is an uncommon method among ransomware groups," the advisory notes.

The gang uses a double extortion model—first stealing and then encrypting victims’ data—forcing organizations to pay not just to restore systems but also to prevent public data leaks.