Skip to navigation

Threat reportRansomwareTL-2026-2229

Winona County, Minnesota Pays $128,539.57 Ransom After January 2026 Ransomware Attack With Data Theft

highRESOLVED

Winona County, Minnesota detected a ransomware attack on January 22, 2026, confirmed a four-day (January 18-22) data-theft window, and paid $128,539.57 to resolve it with insurance assistance; a second, separate ransomware attack hit the county's network on April 7, 2026, prompting a state of emergency and Minnesota National Guard cyber-response activation, and was later self-claimed by the Interlock ransomware group on its leak site.

Key facts

IdentifiersTL-2026-2229
SeverityHIGH
Affected productsWinona County, Minnesota (local government) County government network, including vital statistics/records systems, Department of Motor Vehicles systems, law-enforcement records systems, and financial systems
AttributionInterlock (low confidence)
MalwareAnyDesk, Berserk Stealer, Cobalt Strike, Lumma Stealer - S1213, NodeSnake RAT, SystemBC - S9001, interlock
ToolsAnyDesk, AzCopy, Azure Storage Explorer, Cobalt Strike, PuTTY
MITRE ATT&CK techniquesT1021.001 Remote Services: Remote Desktop Protocol, T1036.005 Match Legitimate Resource Name or Location, T1048 Exfiltration Over Alternative Protocol, T1056.001 Input Capture: Keylogging, T1059.001 Command and Scripting Interpreter: PowerShell, T1078 Valid Accounts, T1082 System Information Discovery, T1204.004 User Execution: Malicious Copy and Paste, T1218.011 System Binary Proxy Execution: Rundll32, T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, T1555.003 Credentials from Web Browsers, T1558.003 Steal or Forge Kerberos Tickets: Kerberoasting and 1 more in the attack flow
MotivationFINANCIAL
Target sectorsgovernment administration, state and local government, public sector
Target regionsNorth America, united states of america, Minnesota
Detection rules9 (1 shown free)
Sources18 cited sources

Detection coverage

As of 2026-08-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2229 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Interlock Run-Key Persistence, conhost.exe Masquerading & Rundll32 Proxy Execution — Post-Exploitation Phase

Splunk SPL search for Interlock's documented post-exploitation tradecraft: a "Chrome Updater" autorun Registry Run key that re-executes the payload at logon (persistence), the final ransomware payload written/renamed as conhost.exe to blend into normal Windows processes (masquerading), abuse of rundll32.exe to proxy-execute a malicious DLL (defense evasion), and Kerberoasting (RC4-encrypted TGS-REQ bursts against non-machine service accounts) for lateral-movement credential access — all per CISA AA25-203A.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1547.001, T1036.005, T1218.011, T1558.003
  • Data sources: sysmon, windows_registry, windows_security, microsoft_defender_for_endpoint
  • Severity: high
  • Confidence: high

Splunk SPL

index=sysmon
( (EventCode=13 TargetObject="*\\CurrentVersion\\Run\\Chrome Updater")
  OR (EventCode=1 Image="*\\conhost.exe" NOT (ParentImage="*\\cmd.exe" OR ParentImage="*\\svchost.exe" OR ParentImage="*\\explorer.exe"))
  OR (EventCode=1 Image="*\\rundll32.exe" (CommandLine="*.dll,*" OR CommandLine="*javascript:*") NOT CommandLine="*InstallSecurityUpdate*")
)
| eval alert_reason=case(
    EventCode=13, "registry_run_key_persistence_chrome_updater",
    EventCode=1 AND Image="*\\conhost.exe", "conhost_masquerading_payload",
    EventCode=1 AND Image="*\\rundll32.exe", "rundll32_proxy_execution")
| table _time, ComputerName, User, EventCode, alert_reason, TargetObject, Details, Image, ParentImage, CommandLine, Hashes
| append
    [ search index=wineventlog sourcetype=WinEventLog:Security EventCode=4769 Ticket_Encryption_Type=0x17
      | where NOT match(Service_Name, "\$$")
      | stats count as ticket_count values(Service_Name) as services by Account_Name, Client_Address
      | where ticket_count >= 3
      | eval alert_reason="kerberoasting_rc4_ticket_requests" ]
| sort -_time

Microsoft KQL

DeviceRegistryEvents
| where Timestamp > ago(24h)
| where RegistryKey has @"CurrentVersion\Run" and RegistryValueName == "Chrome Updater"
| project Timestamp, DeviceName, Account=InitiatingProcessAccountName, Detail=strcat("registry_run_key_persistence: ", RegistryValueData)
| union (
    DeviceProcessEvents
    | where Timestamp > ago(24h)
    | where FileName =~ "conhost.exe"
    | where InitiatingProcessFileName !in~ ("cmd.exe","svchost.exe","explorer.exe")
    | project Timestamp, DeviceName, Account=InitiatingProcessAccountName, Detail=strcat("conhost_masquerading_payload: parent=", InitiatingProcessFileName)
)
| union (
    DeviceProcessEvents
    | where Timestamp > ago(24h)
    | where FileName =~ "rundll32.exe"
    | where ProcessCommandLine has_any (".dll,", "javascript:")
    | where ProcessCommandLine !has "InstallSecurityUpdate"
    | project Timestamp, DeviceName, Account=InitiatingProcessAccountName, Detail=strcat("rundll32_proxy_execution: ", ProcessCommandLine)
)
| union (
    SecurityEvent
    | where TimeGenerated > ago(24h) and EventID == 4769
    | where TicketEncryptionType == "0x17"
    | where ServiceName !endswith "$"
    | summarize TicketCount=count() by TargetAccount=TargetUserName, IpAddress
    | where TicketCount >= 3
    | project Timestamp=now(), DeviceName=IpAddress, Account=TargetAccount, Detail=strcat("kerberoasting_rc4_requests: ", tostring(TicketCount))
)
| order by Timestamp desc

Sigma

title: Interlock Run-Key Persistence, conhost.exe Masquerading & Rundll32 Proxy Execution
id: b2c3d4e5-f6a7-4890-9bcd-ef0123456789
status: experimental
description: Detects Interlock post-exploitation persistence (a "Chrome Updater" autorun Registry Run key), defense evasion via the final ransomware payload masquerading as conhost.exe, and rundll32.exe abused as a system binary proxy to execute a malicious DLL.
references:
    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-203a
author: Threadlinqs Team
date: 2026-08-30
tags:
    - attack.persistence
    - attack.t1547.001
    - attack.defense-evasion
    - attack.t1036.005
    - attack.t1218.011
    - attack.credential-access
    - attack.t1558.003
    - attack.tool.interlock
logsource:
    category: process_creation
    product: windows
detection:
    selection_regkey:
        TargetObject|contains: 'CurrentVersion\Run'
        TargetObject|endswith: 'Chrome Updater'
    selection_masquerade:
        Image|endswith: '\conhost.exe'
    filter_masquerade_legit:
        ParentImage|endswith:
            - '\cmd.exe'
            - '\svchost.exe'
            - '\explorer.exe'
    selection_rundll32:
        Image|endswith: '\rundll32.exe'
        CommandLine|contains:
            - '.dll,'
            - 'javascript:'
    filter_rundll32_legit:
        CommandLine|contains: 'InstallSecurityUpdate'
    condition: selection_regkey or (selection_masquerade and not filter_masquerade_legit) or (selection_rundll32 and not filter_rundll32_legit)
falsepositives:
    - Legitimate Google Chrome updater tasks that use a differently-scoped, code-signed registry entry — verify publisher/signature before alerting
    - Third-party terminal multiplexers, remote shells, or admin tooling that legitimately spawns conhost.exe or rundll32.exe outside the expected parent/argument baseline
level: high

Known false positives:

  • Legitimate Google Chrome updater tasks that use a differently-scoped, code-signed registry entry — verify publisher/signature before alerting
  • Third-party terminal multiplexers, remote-management shells, or packaged installers that legitimately spawn conhost.exe or rundll32.exe outside the expected parent/argument baseline
  • Scheduled Kerberos service-account key rotation or legitimate SPN audits generating bursts of RC4 TGS-REQ requests

Tuning notes: Verify the digital signature/publisher of the process writing the Chrome Updater Run key against Google's legitimate Chrome update mechanism before alerting; enumerate the environment's known conhost.exe/rundll32.exe parent-process and argument baseline to shrink the masquerading and proxy-execution filters; exclude known service accounts that legitimately use RC4 for backward-compatibility.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • ClickFix Fake CAPTCHA to Encoded PowerShell Execution — Exploitation Phase · unlock with TL Creds
  • Interlock Run-Key Persistence, [indicator] Masquerading & Rundll32 Proxy Execution — Post-Exploitation Phase · unlock with TL Creds
  • RDP Lateral Movement, Remote-Access Tool Abuse & Cloud-Storage Exfiltration to Flagged Infrastructure — C2/Lateral Movement Phase · unlock with TL Creds
  • ClickFix Fake CAPTCHA to Encoded PowerShell Execution — Exploitation Phase · unlock with TL Creds
  • Interlock Run-Key Persistence, [indicator] Masquerading & Rundll32 Proxy Execution — Post-Exploitation Phase · unlock with TL Creds
  • RDP Lateral Movement, Remote-Access Tool Abuse & Cloud-Storage Exfiltration to Flagged Infrastructure — C2/Lateral Movement Phase · unlock with TL Creds
  • ClickFix Fake CAPTCHA to Encoded PowerShell Execution — Exploitation Phase · unlock with TL Creds
  • RDP Lateral Movement, Remote-Access Tool Abuse & Cloud-Storage Exfiltration to Flagged Infrastructure — C2/Lateral Movement Phase · unlock with TL Creds

Indicators of compromise

As of 2026-08-28, Threadlinqs Intelligence tracks 16 indicators of compromise for TL-2026-2229.

16 indicators of compromise · unlock with TL Creds. Compare plans

Technical analysis

On January 22, 2026, Winona County, Minnesota (population ~50,000) detected a ransomware intrusion on its government network. Third-party forensic investigators, engaged alongside the FBI and state agencies, determined that unauthorized actors had access to the network for a four-day window from January 18 to January 22, 2026, during which data was exfiltrated. After consulting its cybersecurity team, the county negotiated and paid a ransom of $128,539.57 (approximately $50,000 covered by its insurance carrier, the remainder paid directly by the county) to restore services and protect personal information. The forensic review was not completed until April 16, 2026, and the county did not begin mailing written breach notifications to affected individuals until May 12, 2026 -- nearly four months after detection. Compromised data categories confirmed in the county's official notice include full name, address, Social Security number, driver's license or state identification card number, medical information, information contained in law enforcement reports, financial account information, and a 'PMI Number'; for a limited subset of individuals, payment card data (including CVV/expiration) and online account credentials were also exposed. No ransomware group, malware family, initial-access vector, or technical indicator was ever attributed to this January intrusion in the sourced coverage, and the county has stated it was carried out by different cybercriminals than the group behind the April incident.

A second, separate ransomware attack struck Winona County's network on April 7, 2026 and continued into April 8, significantly impairing the county's ability to deliver municipal services (911, fire, and emergency medical response were not interrupted). The county took affected systems -- including vital statistics and Department of Motor Vehicles systems -- offline and declared a local state of emergency. On April 8, 2026, Minnesota Governor Tim Walz signed an executive order activating a Minnesota National Guard cyber protection team (reported at roughly 15 personnel) to assist recovery, citing an incident whose 'scale and complexity... exceeded both internal and commercial response capabilities.' The county coordinated with Minnesota IT Services, the Minnesota Bureau of Criminal Apprehension, the League of Minnesota Cities, and the FBI. Public-facing systems were restored in phases, reaching near-full operation by April 25, 2026. On April 29-30, 2026, the Interlock ransomware group posted Winona County to its Tor-based data-leak site, claiming to have stolen more than two million files -- described as resident records, tax and budget documents, police records, and data from other county-affiliated institutions -- and publishing sample document images as proof. Ransomware-tracking service ransomware.live logged the posting on May 1, 2026 (10:51 UTC). As of the August 28, 2026 public reporting that prompted this record, Winona County had not confirmed Interlock's specific claim and was still reviewing which individuals' data was affected by the April incident; a class-action investigation into the county's data-security practices was also opened by a plaintiffs' law firm following the January breach notifications.

Interlock is a double-extortion ransomware operation, active since approximately September 2024, that was the subject of a joint CISA/FBI/HHS/MS-ISAC #StopRansomware advisory (AA25-203A, July 22, 2025) covering its targeting of North American and European organizations, including government and healthcare-sector victims. Interlock's documented initial-access methods include drive-by compromise from compromised legitimate websites and malware disguised as browser or security-tool updates (e.g., filenames mimicking FortiClient, GlobalProtect, or Cisco Secure Client installers), as well as the ClickFix social-engineering technique -- a fake CAPTCHA that tricks a user into pasting a base64-encoded PowerShell command into the Windows Run dialog -- and a newer PHP-based FileFix variant. Because Winona County has not independently confirmed the Interlock claim for the April incident and no victim-specific technical indicators have been published, the MITRE ATT&CK techniques mapped below reflect Interlock's documented, advisory-confirmed operational playbook rather than forensic artifacts recovered from Winona County's own network.

MITRE ATT&CK techniques by tactic:

Lateral Movement

T1021.001 Remote Services: Remote Desktop Protocol

Defense Evasion

T1036.005 Match Legitimate Resource Name or Location; T1218.011 System Binary Proxy Execution: Rundll32

Exfiltration

T1048 Exfiltration Over Alternative Protocol; T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage

Credential Access

T1056.001 Input Capture: Keylogging; T1555.003 Credentials from Web Browsers; T1558.003 Steal or Forge Kerberos Tickets: Kerberoasting

Execution

T1059.001 Command and Scripting Interpreter: PowerShell; T1204.004 User Execution: Malicious Copy and Paste

Persistence

T1078 Valid Accounts; T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

Discovery

T1082 System Information Discovery

Remediation

Patches

  • No vendor patch applies -- Interlock's documented initial access (CISA AA25-203A) is social-engineering and drive-by based (ClickFix/FileFix), not tied to a specific CVE

Immediate actions

  • Isolate and take affected network segments offline immediately upon detecting ransomware activity, as Winona County did for both the January and April incidents
  • Engage third-party forensic incident responders and notify the FBI and state law enforcement immediately upon detection
  • Reset domain and local credentials for any account with exposure to compromised hosts, given Interlock's documented browser-credential-theft and Kerberoasting techniques
  • Request state or National Guard cyber-incident support when incident scale exceeds internal and commercial response capacity, as Winona County did via Governor Walz's April 8, 2026 executive order

Workarounds

  • Disable or restrict the Windows Run dialog for standard users to blunt ClickFix-style code execution
  • Apply Group Policy hardening to prevent unauthorized GPO pushes, which Interlock has used to deliver its ransom note

Longer-term hardening

  • Deploy phishing-resistant MFA on all remote-access and domain accounts to blunt Valid Accounts (T1078) and RDP (T1021.001) abuse
  • Restrict user-initiated Windows Run-dialog and PowerShell execution via application control and constrained language mode to mitigate ClickFix/FileFix-style initial access
  • Restrict legitimate remote-access tools (AnyDesk, PuTTY) and cloud-sync utilities (AzCopy, WinSCP, Azure Storage Explorer) to authorized administrative use and alert on unexpected installs
  • Maintain offline, immutable backups of vital records, DMV, and law-enforcement data stores to enable recovery without paying a ransom
  • Segment county department networks (vital records, DMV, law enforcement, finance) to limit lateral spread of a single ransomware intrusion

Affected and fixed versions

  • Winona County, Minnesota (local government) — County government network, including vital statistics/records systems, Department of Motor Vehicles systems, law-enforcement records systems, and financial systems
    Vulnerable versions: N/A - government IT infrastructure, not a versioned software product
    Fixed in: N/A

Timeline

  • Unauthorized actors gain access to Winona County's network, beginning a four-day intrusion and data-theft window later confirmed by third-party forensic investigators.
  • Winona County detects the ransomware attack, ends the unauthorized-access window, and engages third-party forensic experts, the FBI, and state agencies; the county subsequently negotiates and pays a $128,539.57 ransom (about $50,000 covered by its insurance carrier) to restore services and protect personal information.
  • A second, separate ransomware attack is detected on Winona County's network, taking vital statistics, DMV, and other public-facing systems offline and significantly impairing municipal services; the county declares a local state of emergency.
  • Minnesota Governor Tim Walz signs an executive order activating a Minnesota National Guard cyber protection team (~15 personnel) to assist Winona County's recovery, citing incident scale and complexity that exceeded internal and commercial response capabilities.
  • Winona County's forensic review of files affected by the January intrusion is completed, confirming the categories of compromised personal data.
  • Winona County restores affected public-facing systems in phases, reaching near-full operations by April 25, 2026.
  • The Interlock ransomware group posts Winona County to its Tor-based leak site, claiming theft of more than two million files (resident records, tax and budget documents, police records) and publishing sample document images as proof.
  • Ransomware-tracking service ransomware.live logs the Interlock posting for Winona County; the county has not independently confirmed the group's specific claim.
  • A plaintiffs' law firm (Dapeer Law) opens an investigation into a potential class action against Winona County on behalf of residents and employees whose personal information was exposed.
  • Winona County begins mailing written breach-notification letters to individuals affected by the January incident, nearly four months after detection.
  • DataBreaches.net and regional outlets report the $128,539.57 January ransom payment in detail; Winona County confirms its review of the April incident's affected individuals is still ongoing.

Sources cited

Showing 15 of 18 sources, primary sources first.

More from Interlock

Previous and next in ransomware

Drafted by the Threadlinqs research pipeline from 18 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats