Interlock ransomware gang deploys new NodeSnake RAT on universities

The Interlock ransomware gang is deploying a previously undocumented remote access trojan (RAT) named NodeSnake against educational institutes for persistent access to corporate networks. QuorumCyber researchers report seeing NodeSnake's deployment in at least two cases targeting universities in the UK in January and March 2025. The two malware samples significantly differ, indicating active development to add new features and capabilities on NodeSnake. As first reported by BleepingComputer, Interlock is a ransomware group launched in September 2024. It has previously targeted the Texas Tech University, the DaVita kidney dialysis firm, and the Kettering Health medical network in Ohio. The threat group has also been seen leveraging 'ClickFix' attacks that impersonate IT tools to achieve initial infection and network infiltration. The new NodeSnake RAT malware Interlock's latest attacks on educational institutions start with phishing emails carrying malicious links or attachments t ... Read full article.