The Interlock ransomware gang is deploying a previously undocumented remote access trojan (RAT) named NodeSnake against educational institutes for persistent access to corporate networks.

NodeSnake RAT has emerged in the wild, targeting higher education institutions across the UK. Dubbed NodeSnake.

Follow us on Bluesky, Twitter (X), Mastodon and Facebook at @Hackread

Follow us on Bluesky, Twitter (X), Mastodon and Facebook at @Hackread

The CyberWire podcast discusses various cybersecurity incidents and topics. The US government is storing migrant children's DNA in criminal databases, raising privacy concerns. Thousands of ASUS routers are affected by a stealthy backdoor campaign. APT41, a sophisticated threat actor, is leveraging Google Calendar for command and control operations. The Interlock ransomware gang is deploying the NodeSnake RAT against universities. Estonia has issued an arrest warrant related to a significant pharmacy data breach. An Israeli company has thwarted a North Korean cyberattack attempt. Several New England hospitals faced disruption due to a cyberattack. A cybersecurity breach took down the Victoria's Secret website. The podcast features Tim Starks discussing governmental failures in stopping the Salt Typhoon campaign. The show also promotes its daily intelligence briefing and LinkedIn presence.

The Interlock ransomware gang is deploying a previously undocumented remote access trojan (RAT) named NodeSnake against educational institutes for persistent access to corporate networks.

Detect Interlock ransomware group attacks deploying a new PHP-based RAT via FileFix with curated Sigma rules from SOC Prime Platform.

The Interlock ransomware gang is deploying a previously undocumented remote access trojan (RAT) named NodeSnake against educational institutes for persistent access to corporate networks.

Interlock ransomware now uses new NodeSnake RAT for UK educational & government network attacks. #ransomware #nodesnake #cybersecurity

The Interlock ransomware gang exploited a maximum-severity remote code execution vulnerability (CVE-2026-20131) in Cisco Secure Firewall Management Center as a zero-day beginning January 26, 2026, enabling unauthenticated remote Java code execution as root on unpatched devices. Cisco patched the flaw on March 4 after Amazon threat intelligence found Interlock had been exploiting the vulnerability for 36 days, and Interlock — linked to ClickFix — has also deployed NodeSnake and a new AI-era strain called Slopoly while claiming attacks on DaVita, Kettering Health, the Texas Tech University System, and the city of Saint Paul. #Interlock #CiscoSecureFMC

Researchers identified a suspected case of AI-generated malware called Slopoly used by the financially motivated group Hive0163 during a 2026 ransomware intrusion. Slopoly acted as a PowerShell-based C2 persistence client deployed late in the attack chain alongside NodeSnake, InterlockRAT and Interlock ransomware, indicating threat actors are experimenting with LLM-assisted malware generation....

The Interlock ransomware gang is deploying a previously undocumented remote access trojan (RAT) named NodeSnake against educational institutes for persistent access to corporate networks.

Quorum Cyber identifies two new NodeSnake RAT variants, strongly attributed to Interlock ransomware, impacting UK higher education and local government.

The Interlock ransomware gang is deploying a previously undocumented remote access trojan (RAT) named NodeSnake against educational institutes for persistent access to corporate networks. [...]