Threat video1:00
Interlock Hits Schools and Colleges: Detection & IOCs
Interlock hit Community College of Beaver County and claimed Springfield Public Schools; 9 detection rules, 21 IOCs and a free Splunk SPL rule.
Read the full threat intel for Interlock Hits Schools and Colleges: Detection & IOCs →
Chapters
- 0:00The hook33% of education attacks target U.S. schools.
- 0:05The storyRansomware hit three schools in 2026.
- 0:12Attack pathAttackers lured users to ClickFix to run PowerShell.
- 0:29AttributionAttributed to Interlock.
- 0:33Indicators of compromise8 indicators to hunt: 7 file names and 1 registry key.
- 0:39MITRE ATT&CK techniques12 ATT&CK techniques, from initial access to impact.
- 0:43Remediation4 steps now: Block and alert on ClickFix/FileFix patterns.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:0033% of education attacks target U.S. schools.
0:05Ransomware hit three schools in 2026.
0:08Attackers stole student data and demanded payment.
0:13Attackers lured users to ClickFix to run PowerShell.
0:16They harvested credentials and deployed remote access tools.
0:20Then they exfiltrated data to cloud storage and encrypted files.
0:24Instructure confirmed data destruction.
0:29Attributed to Interlock. Confidence: low.
0:348 indicators to hunt: 7 file names and 1 registry key.
0:3912 ATT&CK techniques, from initial access to impact.
0:444 steps now: Block and alert on ClickFix/FileFix patterns.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.