Interlock Ransomware Abuses Volatility3 and WinPmem to Dump Windows Credentials From Memory
Mon Aug 10 2026
Malware
cyberpress.org
Interlock ransomware operators have been observed abusing legitimate forensic tools, Volatility3 and WinPmem, to collect Windows memory and extract credentials from compromised systems. The activity was identified by Sophos Emergency Incident Response during a March 2026 investigation involving a Windows 10 endpoint. Sophos tracks Interlock as GOLD EMBRACE, a ransomware group active since September 2024. […]
The post Interlock Ransomware Abuses Volatility3 and WinPmem to Dump Windows Credentials From Memory appeared first on Cyber Security News.