Interlock ran Volatility3 and WinPmem against a live endpoint to harvest credentials — the responder's own memory-forensics toolkit used in place of a commodity dumper
Sophos's Emergency Incident Response team has published an intrusion in which the Interlock ransomware operator — which Sophos's Counter Threat Unit tracks as GOLD EMBRACE, active since September 2024 against North American and European targets — used the defender's own toolkit for credential access (Sophos X-Ops, 2026-08-07). On the first compromised host, the actor acquired a full physical-memory image using WinPmem, the open-source physical-memory acquisition tool, and then ran Volatility3's Windows plugins against that image offline: the hash-dump plugin to recover account material from the SAM and SYSTEM hive structures resident in memory, and the cached-domain-credential plugin for cached logons. No commodity credential dumper was involved in that step.
The chain around it is otherwise conventional and worth reading for its timing. The user reached a compromised but reputable site through a search result, and five seconds later the page read the clipboard — the ClickFix fingerprint. Eight seconds later, thirteen seconds into the chain, the user pasted an attacker-supplied command into the Run dialog, which fetched a second-stage script and installed a remote-access trojan to run at startup; registry Run-key persistence landed about twenty-five minutes in. The operator then paused for roughly a day before resuming with domain-group enumeration over LDAP, a service-principal-name query consistent with Kerberoasting, and a lateral move to the domain controller over RDP. On the third day, using a compromised domain-administrator account, persistence was re-established through a scheduled task named to imitate the built-in disk-defragmentation task and running a bundled Node.js interpreter. Sophos records the outcome as credential dumping including cloud credentials, access to sensitive files, new domain-administrator accounts, and tampering with endpoint protection — and notes that, across the estate, not all endpoints were in fact running protection of any sort.
The reason this is worth a defender's attention is not novelty of the malware but the inversion it forces. Memory acquisition and Volatility analysis are exactly what an incident responder does, so the on-host artifacts of the attack step and of a legitimate engagement are the same artifacts. Sophos is explicit that adversarial use "would leave similar traces" to a DFIR investigation, a security assessment, or malware analysis, and that what resolved it in this case was that the customer knew of no legitimate activity of that kind.
Triage: memory-acquisition and memory-analysis binaries executing on an endpoint are not anomalous by artifact — they are anomalous by authorisation and by context. The discriminators that survive are organisational rather than technical: whether an engagement, assessment or analysis was actually scheduled on that host at that time; whether the binaries arrived through the change process that normally delivers them or were dropped into a user-writable path; and whether the acquisition ran on a host with a current, unexplained persistence artifact and recent Run-key or scheduled-task creation. A memory image being written to disk by a process whose parent is a user shell or a downloaded stager, rather than by a responder's tooling deployed through management infrastructure, is the sequence worth alerting on.
In March 2026, the Sophos Emergency Incident Response (EIR) team investigated an incident in which we observed the use of the legitimate IR memory analysis tool Volatility3 by the ransomware threat actor Interlock.
Interlock, which Sophos Counter Threat Unit (CTU) researchers track as GOLD EMBRACE, emerged in September 2024.
We found evidence of credential dumping (including AWS credentials), access to sensitive files, addition of new domain-admin accounts, tampering with Defender on the endpoints, and more.
ATT&CK mapping
9 techniques mapped from the cited reporting · MITRE ATT&CK v19.2
Initial Access TA0001
T1189Drive-by Compromise
Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. Multiple ways of delivering exploit code to a browser exist (i.e., Drive-by Target), including:
Execution TA0002
T1053.005Scheduled Task/Job: Scheduled Task
Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The schtasks utility can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel. In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library and Windows Management Instrumentation (WMI) to create a scheduled task. Adversaries may also utilize the Powershell Cmdlet `Invoke-CimMethod`, which leverages WMI class `PS_ScheduledTask` to create a scheduled task via an XML path.
T1204.004User Execution: Malicious Copy and Paste
An adversary may rely upon a user copying and pasting code in order to gain execution. Users may be subjected to social engineering to get them to copy and paste code directly into a Command and Scripting Interpreter. One such strategy is "ClickFix," in which adversaries present users with seemingly helpful solutions—such as prompts to fix errors or complete CAPTCHAs—that instead instruct the user to copy and paste malicious code.
Persistence TA0003
T1053.005Scheduled Task/Job: Scheduled Task
Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The schtasks utility can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel. In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library and Windows Management Instrumentation (WMI) to create a scheduled task. Adversaries may also utilize the Powershell Cmdlet `Invoke-CimMethod`, which leverages WMI class `PS_ScheduledTask` to create a scheduled task via an XML path.
T1547.001Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Privilege Escalation TA0004
T1053.005Scheduled Task/Job: Scheduled Task
Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The schtasks utility can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel. In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library and Windows Management Instrumentation (WMI) to create a scheduled task. Adversaries may also utilize the Powershell Cmdlet `Invoke-CimMethod`, which leverages WMI class `PS_ScheduledTask` to create a scheduled task via an XML path.
T1547.001Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Credential Access TA0006
T1003.002OS Credential Dumping: Security Account Manager
Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through in-memory techniques or through the Windows Registry where the SAM database is stored. The SAM is a database file that contains local accounts for the host, typically those found with the <code>net user</code> command. Enumerating the SAM database requires SYSTEM level access.
T1003.005OS Credential Dumping: Cached Domain Credentials
Adversaries may attempt to access cached domain credentials used to allow authentication to occur in the event a domain controller is unavailable.
T1558.003Steal or Forge Kerberos Tickets: Kerberoasting
Adversaries may abuse a valid Kerberos ticket-granting ticket (TGT) or sniff network traffic to obtain a ticket-granting service (TGS) ticket that may be vulnerable to Brute Force.
Discovery TA0007
T1069.002Permission Groups Discovery: Domain Groups
Adversaries may attempt to find domain-level groups and permission settings. The knowledge of domain-level permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as domain administrators.
Lateral Movement TA0008
T1021.001Remote Services: Remote Desktop Protocol
Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.