# Winona County, Minnesota Pays $128,539.57 Ransom After January 2026 Ransomware Attack With Data Theft

> Winona County, Minnesota detected a ransomware attack on January 22, 2026, confirmed a four-day (January 18-22) data-theft window, and paid $128,539.57 to resolve it with insurance assistance; a second, separate ransomware attack hit the county's network on April 7, 2026, prompting a state of emergency and Minnesota National Guard cyber-response activation, and was later self-claimed by the Interlock ransomware group on its leak site.

- **Published:** 2026-08-28T00:00:00Z
- **Last reviewed:** 2026-08-28T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2229
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-winona-county-interlock-attacks-tl-2026-2229.webp?v=ef157f3c (Threadlinqs threat intel: Winona County $128K Ransom, Interlock: Detection & IOCs (TL-2026-2229) — High severity, 16 IOCs, 9 detection rules.)
- **ID:** TL-2026-2229
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** RESOLVED
- **Actor:** Interlock
- **Detections:** 9 (1 shown free below) · **IOCs:** 16

## Description

On January 22, 2026, Winona County, Minnesota (population ~50,000) detected a ransomware intrusion on its government network. Third-party forensic investigators, engaged alongside the FBI and state agencies, determined that unauthorized actors had access to the network for a four-day window from January 18 to January 22, 2026, during which data was exfiltrated. After consulting its cybersecurity team, the county negotiated and paid a ransom of $128,539.57 (approximately $50,000 covered by its insurance carrier, the remainder paid directly by the county) to restore services and protect personal information. The forensic review was not completed until April 16, 2026, and the county did not begin mailing written breach notifications to affected individuals until May 12, 2026 -- nearly four months after detection. Compromised data categories confirmed in the county's official notice include full name, address, Social Security number, driver's license or state identification card number, medical information, information contained in law enforcement reports, financial account information, and a 'PMI Number'; for a limited subset of individuals, payment card data (including CVV/expiration) and online account credentials were also exposed. No ransomware group, malware family, initial-access vector, or technical indicator was ever attributed to this January intrusion in the sourced coverage, and the county has stated it was carried out by different cybercriminals than the group behind the April incident.

A second, separate ransomware attack struck Winona County's network on April 7, 2026 and continued into April 8, significantly impairing the county's ability to deliver municipal services (911, fire, and emergency medical response were not interrupted). The county took affected systems -- including vital statistics and Department of Motor Vehicles systems -- offline and declared a local state of emergency. On April 8, 2026, Minnesota Governor Tim Walz signed an executive order activating a Minnesota National Guard cyber protection team (reported at roughly 15 personnel) to assist recovery, citing an incident whose 'scale and complexity... exceeded both internal and commercial response capabilities.' The county coordinated with Minnesota IT Services, the Minnesota Bureau of Criminal Apprehension, the League of Minnesota Cities, and the FBI. Public-facing systems were restored in phases, reaching near-full operation by April 25, 2026. On April 29-30, 2026, the Interlock ransomware group posted Winona County to its Tor-based data-leak site, claiming to have stolen more than two million files -- described as resident records, tax and budget documents, police records, and data from other county-affiliated institutions -- and publishing sample document images as proof. Ransomware-tracking service ransomware.live logged the posting on May 1, 2026 (10:51 UTC). As of the August 28, 2026 public reporting that prompted this record, Winona County had not confirmed Interlock's specific claim and was still reviewing which individuals' data was affected by the April incident; a class-action investigation into the county's data-security practices was also opened by a plaintiffs' law firm following the January breach notifications.

Interlock is a double-extortion ransomware operation, active since approximately September 2024, that was the subject of a joint CISA/FBI/HHS/MS-ISAC #StopRansomware advisory (AA25-203A, July 22, 2025) covering its targeting of North American and European organizations, including government and healthcare-sector victims. Interlock's documented initial-access methods include drive-by compromise from compromised legitimate websites and malware disguised as browser or security-tool updates (e.g., filenames mimicking FortiClient, GlobalProtect, or Cisco Secure Client installers), as well as the ClickFix social-engineering technique -- a fake CAPTCHA that tricks a user into pasting a base64-encoded PowerShell command into the Windows Run dialog -- and a newer PHP-based FileFix variant. Because Winona County has not independently confirmed the Interlock claim for the April incident and no victim-specific technical indicators have been published, the MITRE ATT&CK techniques mapped below reflect Interlock's documented, advisory-confirmed operational playbook rather than forensic artifacts recovered from Winona County's own network.

## MITRE ATT&CK

- T1204.004 User Execution: Malicious Copy and Paste
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
- T1078 Valid Accounts
- T1036.005 Match Legitimate Resource Name or Location
- T1218.011 System Binary Proxy Execution: Rundll32
- T1555.003 Credentials from Web Browsers
- T1558.003 Steal or Forge Kerberos Tickets: Kerberoasting
- T1056.001 Input Capture: Keylogging
- T1082 System Information Discovery
- T1021.001 Remote Services: Remote Desktop Protocol
- T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage
- T1048 Exfiltration Over Alternative Protocol

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Interlock Run-Key Persistence, conhost.exe Masquerading & Rundll32 Proxy Execution — Post-Exploitation Phase** (`TL-2026-2229-SPL-002`)

Splunk SPL search for Interlock's documented post-exploitation tradecraft: a "Chrome Updater" autorun Registry Run key that re-executes the payload at logon (persistence), the final ransomware payload written/renamed as conhost.exe to blend into normal Windows processes (masquerading), abuse of rundll32.exe to proxy-execute a malicious DLL (defense evasion), and Kerberoasting (RC4-encrypted TGS-REQ bursts against non-machine service accounts) for lateral-movement credential access — all per CISA AA25-203A.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1547.001, T1036.005, T1218.011, T1558.003
- **Data sources:** sysmon, windows_registry, windows_security, microsoft_defender_for_endpoint
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon
( (EventCode=13 TargetObject="*\\CurrentVersion\\Run\\Chrome Updater")
  OR (EventCode=1 Image="*\\conhost.exe" NOT (ParentImage="*\\cmd.exe" OR ParentImage="*\\svchost.exe" OR ParentImage="*\\explorer.exe"))
  OR (EventCode=1 Image="*\\rundll32.exe" (CommandLine="*.dll,*" OR CommandLine="*javascript:*") NOT CommandLine="*InstallSecurityUpdate*")
)
| eval alert_reason=case(
    EventCode=13, "registry_run_key_persistence_chrome_updater",
    EventCode=1 AND Image="*\\conhost.exe", "conhost_masquerading_payload",
    EventCode=1 AND Image="*\\rundll32.exe", "rundll32_proxy_execution")
| table _time, ComputerName, User, EventCode, alert_reason, TargetObject, Details, Image, ParentImage, CommandLine, Hashes
| append
    [ search index=wineventlog sourcetype=WinEventLog:Security EventCode=4769 Ticket_Encryption_Type=0x17
      | where NOT match(Service_Name, "\$$")
      | stats count as ticket_count values(Service_Name) as services by Account_Name, Client_Address
      | where ticket_count >= 3
      | eval alert_reason="kerberoasting_rc4_ticket_requests" ]
| sort -_time
```

### Microsoft KQL

```kql
DeviceRegistryEvents
| where Timestamp > ago(24h)
| where RegistryKey has @"CurrentVersion\Run" and RegistryValueName == "Chrome Updater"
| project Timestamp, DeviceName, Account=InitiatingProcessAccountName, Detail=strcat("registry_run_key_persistence: ", RegistryValueData)
| union (
    DeviceProcessEvents
    | where Timestamp > ago(24h)
    | where FileName =~ "conhost.exe"
    | where InitiatingProcessFileName !in~ ("cmd.exe","svchost.exe","explorer.exe")
    | project Timestamp, DeviceName, Account=InitiatingProcessAccountName, Detail=strcat("conhost_masquerading_payload: parent=", InitiatingProcessFileName)
)
| union (
    DeviceProcessEvents
    | where Timestamp > ago(24h)
    | where FileName =~ "rundll32.exe"
    | where ProcessCommandLine has_any (".dll,", "javascript:")
    | where ProcessCommandLine !has "InstallSecurityUpdate"
    | project Timestamp, DeviceName, Account=InitiatingProcessAccountName, Detail=strcat("rundll32_proxy_execution: ", ProcessCommandLine)
)
| union (
    SecurityEvent
    | where TimeGenerated > ago(24h) and EventID == 4769
    | where TicketEncryptionType == "0x17"
    | where ServiceName !endswith "$"
    | summarize TicketCount=count() by TargetAccount=TargetUserName, IpAddress
    | where TicketCount >= 3
    | project Timestamp=now(), DeviceName=IpAddress, Account=TargetAccount, Detail=strcat("kerberoasting_rc4_requests: ", tostring(TicketCount))
)
| order by Timestamp desc
```

### Sigma

```yaml
title: Interlock Run-Key Persistence, conhost.exe Masquerading & Rundll32 Proxy Execution
id: b2c3d4e5-f6a7-4890-9bcd-ef0123456789
status: experimental
description: Detects Interlock post-exploitation persistence (a "Chrome Updater" autorun Registry Run key), defense evasion via the final ransomware payload masquerading as conhost.exe, and rundll32.exe abused as a system binary proxy to execute a malicious DLL.
references:
    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-203a
author: Threadlinqs Team
date: 2026-08-30
tags:
    - attack.persistence
    - attack.t1547.001
    - attack.defense-evasion
    - attack.t1036.005
    - attack.t1218.011
    - attack.credential-access
    - attack.t1558.003
    - attack.tool.interlock
logsource:
    category: process_creation
    product: windows
detection:
    selection_regkey:
        TargetObject|contains: 'CurrentVersion\Run'
        TargetObject|endswith: 'Chrome Updater'
    selection_masquerade:
        Image|endswith: '\conhost.exe'
    filter_masquerade_legit:
        ParentImage|endswith:
            - '\cmd.exe'
            - '\svchost.exe'
            - '\explorer.exe'
    selection_rundll32:
        Image|endswith: '\rundll32.exe'
        CommandLine|contains:
            - '.dll,'
            - 'javascript:'
    filter_rundll32_legit:
        CommandLine|contains: 'InstallSecurityUpdate'
    condition: selection_regkey or (selection_masquerade and not filter_masquerade_legit) or (selection_rundll32 and not filter_rundll32_legit)
falsepositives:
    - Legitimate Google Chrome updater tasks that use a differently-scoped, code-signed registry entry — verify publisher/signature before alerting
    - Third-party terminal multiplexers, remote shells, or admin tooling that legitimately spawns conhost.exe or rundll32.exe outside the expected parent/argument baseline
level: high
```

**Known false positives:**

- Legitimate Google Chrome updater tasks that use a differently-scoped, code-signed registry entry — verify publisher/signature before alerting
- Third-party terminal multiplexers, remote-management shells, or packaged installers that legitimately spawn conhost.exe or rundll32.exe outside the expected parent/argument baseline
- Scheduled Kerberos service-account key rotation or legitimate SPN audits generating bursts of RC4 TGS-REQ requests

**Tuning notes:** Verify the digital signature/publisher of the process writing the Chrome Updater Run key against Google's legitimate Chrome update mechanism before alerting; enumerate the environment's known conhost.exe/rundll32.exe parent-process and argument baseline to shrink the masquerading and proxy-execution filters; exclude known service accounts that legitimately use RC4 for backward-compatibility.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- ClickFix Fake CAPTCHA to Encoded PowerShell Execution — Exploitation Phase (locked: unlock with TL Creds)
- Interlock Run-Key Persistence, [indicator] Masquerading & Rundll32 Proxy Execution — Post-Exploitation Phase (locked: unlock with TL Creds)
- RDP Lateral Movement, Remote-Access Tool Abuse & Cloud-Storage Exfiltration to Flagged Infrastructure — C2/Lateral Movement Phase (locked: unlock with TL Creds)
- ClickFix Fake CAPTCHA to Encoded PowerShell Execution — Exploitation Phase (locked: unlock with TL Creds)
- Interlock Run-Key Persistence, [indicator] Masquerading & Rundll32 Proxy Execution — Post-Exploitation Phase (locked: unlock with TL Creds)
- RDP Lateral Movement, Remote-Access Tool Abuse & Cloud-Storage Exfiltration to Flagged Infrastructure — C2/Lateral Movement Phase (locked: unlock with TL Creds)
- ClickFix Fake CAPTCHA to Encoded PowerShell Execution — Exploitation Phase (locked: unlock with TL Creds)
- RDP Lateral Movement, Remote-Access Tool Abuse & Cloud-Storage Exfiltration to Flagged Infrastructure — C2/Lateral Movement Phase (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Winona County paid more than $128K following January ransomware attack](https://databreaches.net/2026/08/28/winona-county-paid-more-than-128k-following-january-ransomware-attack/)
- [Winona County paid more than $128K following January ransomware attack](https://www.wxow.com/news/top-stories/winona-county-paid-more-than-128k-following-january-ransomware-attack/article_f0f50758-e602-44d1-8c25-54b79f31c219.html)
- [Winona County paid hackers $128K after back-to-back ransomware attacks in 2026, Social Security numbers may be at risk](https://www.wxow.com/news/crime/winona-county-paid-hackers-128k-after-back-to-back-ransomware-attacks-in-2026-social-security/article_327a85bf-46be-4fdc-a5d8-77b9055efb63.html)
- [Winona County says it paid $128K after January ransomware attack](https://www.news8000.com/news/winona-county-says-it-paid-128k-after-january-ransomware-attack/article_80f8e7ad-67a8-40a4-a0a0-47cc2597f086.html)
- [Winona County hit by second ransomware attack in three months](https://www.news8000.com/news/local-news/winona/winona-county-hit-by-second-ransomware-attack-in-three-months/article_96e7f4ab-6f64-4f02-abd6-1cdda633d491.html)
- [Notice of Data Security Incident](https://www.winonacounty.gov/31/Notice-of-Data-Security-Incident)
- [Winona County, insurer paid $128K in ransom in January cyberattack](https://www.winonapost.com/news/winona-county-insurer-paid-128k-in-ransom-in-january-cyberattack/article_4c4a03df-24c0-4c19-825e-708e57947171.html)
- [Winona County: Hackers released personal data](https://www.winonapost.com/news/winona-county-hackers-released-personal-data/article_93451c81-50cc-4d48-b36c-61ed1961275a.html)
- [Winona County suffers 2nd cyberattack; National Guard mobilized](https://www.winonapost.com/news/winona-county-suffers-2nd-cyberattack-national-guard-mobilized/article_ab3d78d2-4348-40db-a7e0-5fdd28611217.html)
- [Cybercriminals say they hacked Winona County, MN (again)](https://www.comparitech.com/news/cybercriminals-say-they-hacked-winona-county-mn-again/)
- [Interlock Ransomware Attack on Winona County](https://www.dexpose.io/interlock-ransomware-attack-on-winona-county/)
- [Ransomware.live - Victim: Winona County](https://ransomware.live/id/V2lub25hIENvdW50eUBpbnRlcmxvY2s=)
- [#StopRansomware: Interlock (CISA AA25-203A)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-203a)
- [Interlock Ransomware Analysis, Simulation, and Mitigation - CISA Alert AA25-203A](https://www.picussecurity.com/resource/blog/cisa-alert-aa25-203a-interlock-ransomware-analysis)
- [Minnesota governor sends national guard to county after cyberattack](https://therecord.media/minnesota-sends-national-guard-after-local-cyberattack)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2229