Volatility3 is a memory forensics framework. Incident responders use it to analyse a memory image after a compromise — to find what was running, what was injected, and what credentials were resident when the machine was captured.
In a March 2026 Interlock ransomware intrusion, the attackers used it for that last part.
Volatility3 was deployed to extract domain credentials, NTLM hashes and user account information from memory — the same capability, pointed the other way.
Why this is worse than it sounds
Credential dumping from memory is not new. What is notable is the tool.
An attacker running Mimikatz is running something every endpoint product on the market knows by name. An attacker running Volatility3 is running a legitimate, open-source, widely-used forensics framework that a security team might have installed deliberately — and that a detection rule flagging it would flag every time the incident response team did their job.
This is living-off-the-land applied to the defensive toolkit itself. The same logic that makes attackers use PowerShell, PsExec and Cloudflared: pick something that is already trusted, already present, or already unremarkable.
And there is a particular sting in this one. A tool for understanding a compromise is being used to deepen it.
The rest of the chain was ordinary
Around that one interesting step, the intrusion is a standard sequence:
- Drive-by compromise, then a ClickFix lure — the pattern where a page instructs the visitor to paste something into a terminal or Run dialog to "fix" a problem
- PowerShell delivering a RAT payload
- Persistence
- Discovery
- Privilege escalation
- Lateral movement
ClickFix deserves the attention it gets. It works because it does not exploit anything — it asks the user to run the command, and the user does, because the page has framed it as a repair.
Interlock has pushed fake IT tools through ClickFix before, which suggests it is a reliable enough entry point for them to keep using it.
Interlock is not a small operation
The group has been active since mid-2024 and has grown into a multi-skilled operation willing to adapt and go after large targets.
The most relevant marker for anyone tracking them: Interlock was exploiting the Cisco Secure FMC vulnerability CVE-2026-20131 from 26 January 2026 — zero-day exploitation of a firewall management platform, which is a different tier of capability from phishing lures.
That combination is worth noting. The same group runs commodity social engineering at the front door and zero-day exploitation of security appliances. Those are usually different actors. Here they are the same one, choosing whichever is cheaper for the target in front of them.
We covered a separate Cisco Secure FMC zero-day earlier; the pattern of ransomware crews reaching for security-appliance vulnerabilities is now well established rather than exceptional.
What to do about the specific technique
- Alert on forensics tooling appearing outside IR. Volatility3 on a machine where no investigation is running should be an alert. The rule has to be scoped by context rather than by binary, which is more work than a blocklist and the only version that works.
- Reduce what is resident in memory. Credential Guard, LSA protection and limiting where domain admin accounts log in shrink what any memory-dumping technique yields, regardless of the tool used.
- Detect ClickFix at the paste, not the page. The observable moment is a user pasting an encoded command into Run or a terminal. That telemetry exists on most endpoints and is not widely alerted on.
- Watch for the sequence, not the tools. Every individual step here is legitimate software. The order is what is not.
The pattern worth internalising
Interlock did not need a novel capability. It needed a user to paste a command, PowerShell to run, and a forensics tool to do exactly what it was designed to do.
Detection built around "is this program malicious" struggles with all three. Detection built around "should this program be doing this, here, now, in this order" is the harder thing to build and the only thing that catches this.
