Shared C2 platform reshapes ransomware operations

Security researchers have identified a new command and control framework, tracked in technical reporting as InterLock, being used by several ransomware operations. The platform is a control layer for compromised systems rather than a new encryption family. It gives operators a common way to manage hosts, issue commands, stage data and coordinate extortion while each group retains its own loader, encryptor and affiliate network.

That combination is changing the defensive challenge. Security teams can no longer treat every ransomware campaign as an isolated collection of malware, since a reusable panel may connect activity attributed to different brands or affiliate clusters. For Australian organisations, the risk extends beyond large financial institutions to cloud customers, logistics companies, healthcare providers and small businesses supported by managed service providers.

InterLock should also be understood as an evolving platform, not a single immutable tool. Researchers have observed updated commands, infrastructure and administration features over time. Shared code or panel behaviour does not prove that the operators belong to one criminal organisation, meaning incident attribution requires careful analysis of the surrounding activity.

From bespoke panels to shared infrastructure

A useful historical counterpoint appears in the August 2017 archive, when ransomware campaigns were more often associated with separate botnets, bespoke command tools and distinct encryption payloads. Operators still shared techniques, but each infection typically exposed its own infrastructure and control patterns. That made infrastructure-based blocking comparatively effective for some campaigns.

The newer model separates the controller from the ransomware itself. A loader gains initial access, a stealer or credential-harvesting tool collects information, and the C2 framework gives the operator a unified interface for controlling the compromised environment. Individual groups can modify the encryption stage or exchange affiliates without rebuilding the entire administrative layer.

Multi-tenant functions make this attractive to criminal businesses seeking economies of scale. Separate customers may share panel software, authentication systems and hosting practices while appearing to run unrelated campaigns. The result resembles a criminal cloud service, complete with operator accounts, tasking menus, statistics and status information for active intrusions.

How the control layer supports extortion

Researchers report the use of encrypted web traffic to blend command traffic with ordinary HTTPS sessions. C2 hosts may sit on cloud platforms, compromised websites or other rented infrastructure, while changing paths and request patterns make simple domain blocking less reliable. The address may be disposable, but the account, certificate, timing and behavioural pattern can still provide useful signals.

The panel also creates an opening for ordinary phishing material. Operators can pair access to the control layer with commodity lures, including fake system notifications that imitate operating-system warnings and encourage users to open a malicious script or archive. Once access is established, the framework gives the attacker a more capable environment in which to work.

A typical intrusion may move from initial access to credential collection, discovery and lateral movement before data staging and encryption. C2 features can provide file browsing, command execution, process control and information about the infected host. Some functions are integrated into the panel, while others connect to separate malware modules. This flexibility lets operators choose the desired outcome and delay encryption when stealth or data theft remains the priority.

Shared code, uncertain alliances

Technical overlap creates an attribution problem for defenders and law enforcement. Identical panel layouts, uncommon command strings or the same pool of compromised systems may indicate common access, copied source code or shared service providers. They may also result from one group selling access to another, creating an intelligence gap between the operator visible on the C2 server and the affiliate conducting the intrusion.

A capability comparison highlights the operational shift:

Capability	Earlier ransomware pattern	Shared C2 framework pattern	Security consequence
Operator access	Bespoke panel for one campaign	Reusable or multi-tenant administration	A compromise may affect several operations
Network traffic	Simple protocols or predictable domains	HTTPS sessions using rotating infrastructure	Domain blocking alone provides limited coverage
Command execution	Fixed scripts and limited control	Expandable tasking and remote-control functions	Activity varies according to the selected module
Data collection	Separate exfiltration utilities	Integrated browsing and staging features	Theft may occur before encryption is visible
Operator identity	A small number of dedicated accounts	More structured affiliate or tenant accounts	Authentication and identity telemetry become critical

Attribution therefore requires more than finding a shared IP address. Investigators may need panel artefacts, malware samples, authentication artefacts, ransom-note language and victimology. A shared framework can make several incidents look connected even where the encryption code, negotiation process and ultimate beneficiary differ.

Why Australian organisations are exposed

Sydney, Melbourne and Brisbane contain large concentrations of financial, professional-services and technology operations, many of which depend on contractors and shared service providers. Australian mid-market companies may appear less attractive than multinational targets, yet a supplier account can provide a path into a larger customer. Remote administration tools, unsupported appliances and neglected backups continue to give attackers practical entry points.

The country’s trade and logistics networks create another distinctive exposure. Customs brokers, freight operators and port-related businesses in Melbourne and Brisbane often exchange sensitive documents through email, document portals and compact teams with limited security capacity. These environments illustrate how a cyber intrusion can affect physical trade without directly touching a shipping container or border system.

Human manipulation is adding pressure from another direction. Australian companies have also faced deepfake CEO impersonation, with familiar-sounding audio used to pressure employees into approving payments or disclosing credentials. A sophisticated C2 panel can turn a convincing request for access into a controlled intrusion, making voice authentication alone a weak safeguard.

Detection and reporting under Australian rules

Defensive monitoring must cover both infrastructure and behaviour. Security teams should examine unusual outbound destinations, long-lived TLS sessions, irregular remote-administration traffic, access to cloud storage and repeated authentication from unusual locations. Endpoint telemetry remains important because command activity can resemble administrative work when the attacker uses legitimate tools such as PowerShell, remote desktops or native management utilities.

The Australian Signals Directorate’s Australian Cyber Security Centre and the Joint Cyber Security Centre provide coordinated advice and incident support for organisations confronting ransomware. Reporting through Report Cyber can contribute to national threat intelligence, while the AFP’s Cybercrime Command can investigate criminal activity. The ASD’s Critical Infrastructure Security Unit also engages directly with operators in essential sectors, supporting information sharing across electricity, transport, communications and other systems.

Organisations covered by the Privacy Act 1988 must assess suspected data breaches against the Notifiable Data Breaches scheme. An eligible breach generally requires notification to the Office of the Australian Information Commissioner as soon as practicable and within three months after the organisation becomes aware that it is an eligible breach. Ransomware recovery, legal advice and forensic preservation may occur alongside this reporting process, but they do not replace the notification assessment.

Containment priorities should begin with isolating affected systems, protecting forensic evidence and revoking credentials that may have entered the C2 environment. Historical backups need testing before restoration, while encryption or reimaging decisions depend on the attacker’s level of access. Australian companies should coordinate technical, legal, insurer and law-enforcement contacts early, since the operator may still be present when the first ransom note appears.

The next phase of ransomware infrastructure

The shared panel is likely to evolve alongside cloud adoption. Operators can place command infrastructure close to the services their victims already use, including business email, collaboration platforms and cloud providers. Remote management, peer-to-peer proxies and access through compromised servers make traffic harder to distinguish from authorised activity, forcing defenders to combine endpoint, identity and network evidence.

The Australian cybersecurity market is already responding with more extensive identity controls, managed detection and cyber-insurance assessments. Smaller providers may also become distribution points when attackers abuse trusted administration accounts. The economics of shared infrastructure reward this approach because one development can be deployed across many intrusions without recreating the entire toolchain.

As ransomware becomes a service business built around reusable infrastructure, the decisive weakness may be the common control layer rather than any single encryptor. InterLock illustrates how criminal groups can share engineering while preserving separate public identities. That shift turns command-and-control resilience into a board-level measure of ransomware readiness, with interoperability and identity controls now shaping whether a shared panel becomes a shared point of failure.