A new Ransomware operation named “Interlock” has been attacking organizations worldwide, publishing data allegedly stolen from six (6) organizations since September 2024. Researchers have discovered Interlock variants built to encrypt FreeBSD servers, an operating system that is not usually targeted in ransomware operations. Experts speculate that Interlock targets FreeBSD because it is widely utilized in servers and critical infrastructure. Interlock engages in double extortion attacks: both encrypting critical systems and demanding ransom to suppress publication of stolen data. Interlock targets Windows as well as FreeBSD operating systems, clearing Windows event logs and self-destructing after encrypting files. Files encrypted by the ransomware are appended with a “.interlock” extension and a ransom note named “!___README___!.txt” is left in directories instructing victims on how to access a Tor site for payment negotiations. Interlock’s operations are relatively new, and there is still much to uncover about the threat actor’s tactics, techniques, and procedures. CTIX analysts will continue to report on new and emerging form of malware and associated campaigns.