OTX Threat: Interlock and Rhysida within the Ransomware Ecosystem

This analysis examines over two years of observations on the ransomware ecosystem surrounding Interlock and Rhysida threat groups. Hive0163 (Interlock) employs custom malware including NodeSnake, InterlockRAT, JunkFiction downloader, Supper, and Interlock ransomware, with identified links to TAG-124. Rhysida actors utilize Endico downloader, Broomstick, Supper, and Tomb crypter, showing relationsh CVEs: CVE-2023-36036, CVE-2026-20131 Sectors: Aerospace, Agriculture, Chemical