Attacks by Interlock involved infiltration of targeted corporate networks and data exfiltration before proceeding with lateral movement, file encryption, and double-extortion activities, according to a Trend Micro report. Further analysis of the operation’s Windows encryptor revealed its capability to remove Windows event logs and the primary binary in the event self-deletion is activated.

Source: SC Magazine