Interlock Hotta Killer Service Creation

Aaron Beardslee@abeardslee

•updated Jan 30, 2026•1•0•26

Detects the creation or start of a Windows service with a name pattern 'UpdateCheckerX64_{random-numbers}'. This is a characteristic behavior of the 'Hotta Killer' tool used by the Interlock ransomware group to load a vulnerable driver (CVE-2025-61155) for disabling security products.