DeadLock Ransomware: A Sophisticated Threat with Decentralized Resilience
First detected in July 2025, DeadLock is a financially motivated ransomware operation that employs double extortion encrypting enterprise data while threatening to leak stolen files. The group’s tactics blend traditional intrusion methods with decentralized infrastructure, making disruption difficult.
Key Tactics and Technical Details
DeadLock’s malware, written in Rust, begins by XOR-decoding an embedded configuration before checking system language settings. If the victim’s system is set to Russian, Ukrainian, Belarusian, several CIS languages, or select Middle Eastern countries (Iran, Syria, Oman, Yemen), the malware self-deletes, suggesting regional avoidance rather than direct attribution.
On non-elevated systems, DeadLock forces UAC prompts via ShellExecuteW to gain administrative privileges. Once elevated, it enables high-level privileges (SeDebugPrivilege, SeBackupPrivilege, SeRestorePrivilege) to disable security tools and recovery mechanisms.
The ransomware aggressively disrupts defenses by:
- Stopping critical services (Windows Defender, VSS, Hyper-V, Active Directory, backup software).
- Killing processes (MsMpEng, PowerShell, Task Manager, cloud-sync clients, remote-access tools).
- Clearing Windows Event Logs (Security, System, Application) and disabling custom telemetry channels via registry modifications.
- Emptying Recycle Bins and registering a custom
.dlockfile extension with a unique icon.
Encryption and Post-Attack Workflow
DeadLock uses XChaCha20 encryption with per-file Curve25519 ECDH keys, making decryption without the attacker’s private key practically impossible. Large files are partially encrypted in 512-byte blocks to accelerate impact on databases, VMs, and backups. The malware throttles resource usage (pausing if CPU exceeds 70% or memory hits 29%) to evade behavioral detection.
After encryption, victims receive a local HTML recovery chat (RECOVERY_CHAT.<UID>.html), which connects to Polygon smart contracts for proxy addresses and leak-blog content. Communications are routed through Session’s onion-routed network, while stolen files may be hosted on Wasabi’s S3-compatible storage. This decentralized infrastructure complicates takedown efforts, though dependencies on public RPC endpoints and proxies remain exploitable.
Victim Profile and Attribution
By July 2026, Microsoft’s Threat Intelligence identified over 80 victims, with more than half in Europe. Targeted sectors include IT, mining, logistics, manufacturing, hospitality, and consumer goods. Microsoft links DeadLock to multiple threat groups, including affiliates from the Lynx and INC ransomware ecosystems, suggesting an affiliate-driven access model rather than a single organized crew.
Indicators of Compromise (IOCs)
- SHA-256:
a1fdf65020ce4a0f0940c793c6425baf8a0b994ec48b9baaf72788661a9d29f4(DeadLock encryptor) - Leak sites:
deadlock.liveblog365[.]comdlock.liveblog365[.]comdeadblogdbdu5wprek7wa2o4ce7rnt6u6ntqeud3hzjjcveosgpsqqqd[.]onion
DeadLock’s aggressive anti-forensic measures, sound cryptography, and decentralized command-and-control make it a persistent and adaptive threat in the ransomware landscape.
Source: https://gbhackers.com/deadlock-ransomware-attack/
Exelasis cybersecurity rating report: https://www.rankiteo.com/company/exelasis-ltd
"id": "EXE1786436694",
"linkid": "exelasis-ltd",
"type": "Ransomware",
"date": "7/2025",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'industry': ['Technology',
'Mining',
'Transportation',
'Manufacturing',
'Hospitality',
'Retail'],
'location': 'Europe (majority), other regions',
'type': ['IT',
'Mining',
'Logistics',
'Manufacturing',
'Hospitality',
'Consumer Goods']}],
'attack_vector': 'Initial access via affiliates (Lynx/INC ecosystems), '
'privilege escalation, and lateral movement',
'data_breach': {'data_encryption': 'XChaCha20 with Curve25519 ECDH keys',
'data_exfiltration': True,
'file_types_exposed': ['Databases',
'VMs',
'Backups',
'Other enterprise files'],
'sensitivity_of_data': 'High (encrypted and exfiltrated)',
'type_of_data_compromised': ['Enterprise data',
'Potentially PII/payment '
'information']},
'date_detected': '2025-07-01',
'date_publicly_disclosed': '2025-07-01',
'description': 'DeadLock is a financially motivated ransomware operation '
'employing double extortion, encrypting enterprise data while '
'threatening to leak stolen files. The group uses '
'decentralized infrastructure and advanced anti-forensic '
'measures to evade disruption.',
'impact': {'brand_reputation_impact': 'Potential reputational damage due to '
'data leaks',
'data_compromised': 'Enterprise data encrypted and exfiltrated',
'identity_theft_risk': 'High (if PII was exfiltrated)',
'operational_impact': 'Disruption of critical services, backup '
'software, and security tools',
'payment_information_risk': 'High (if payment data was '
'exfiltrated)',
'systems_affected': 'Windows systems, databases, VMs, backups, '
'Active Directory'},
'initial_access_broker': {'entry_point': 'Affiliate-driven access (Lynx/INC '
'ecosystems)'},
'investigation_status': 'Ongoing (as of July 2026)',
'lessons_learned': 'Decentralized infrastructure complicates takedown '
'efforts; aggressive anti-forensic measures hinder '
'detection and recovery.',
'motivation': 'Financial gain',
'post_incident_analysis': {'corrective_actions': 'Implement enhanced '
'monitoring, network '
'segmentation, and backup '
'testing',
'root_causes': 'Initial access via affiliates, '
'privilege escalation, lack of '
'behavioral detection for '
'ransomware activity'},
'ransomware': {'data_encryption': True,
'data_exfiltration': True,
'ransomware_strain': 'DeadLock'},
'recommendations': ['Enhance monitoring for privilege escalation attempts',
'Implement network segmentation to limit lateral movement',
'Deploy behavioral WAF and on-demand scrubbing services',
'Regularly test backup and recovery procedures',
'Monitor for IOCs (e.g., DeadLock encryptor SHA-256, leak '
'sites)'],
'references': [{'date_accessed': '2026-07-01',
'source': 'Microsoft Threat Intelligence'},
{'source': 'DeadLock Leak Sites',
'url': 'http://deadlock.liveblog365[.]com'},
{'source': 'DeadLock Leak Sites (Onion)',
'url': 'http://dlock.liveblog365[.]com'},
{'source': 'DeadLock Onion Blog',
'url': 'http://deadblogdbdu5wprek7wa2o4ce7rnt6u6ntqeud3hzjjcveosgpsqqqd[.]onion'}],
'response': {'communication_strategy': 'Local HTML recovery chat with '
'decentralized communication (Session, '
'Polygon smart contracts)',
'containment_measures': 'Disabling security tools, killing '
'processes, clearing event logs'},
'threat_actor': ['DeadLock Ransomware Group',
'Lynx Affiliates',
'INC Ransomware Ecosystem'],
'title': 'DeadLock Ransomware Attack',
'type': 'Ransomware'}