Actor Profile

DeadLock is a financially motivated ransomware operation first observed in July 2025. It is not attributed to a single threat actor but has been deployed by multiple groups, including affiliates of the Lynx and INC ransomware ecosystems. The operation employs a ransomware-as-a-service (RaaS) model, leveraging decentralized infrastructure including the Session messaging network and blockchain-backed services for victim communications, negotiations, and data leak operations. The malware's geofencing behavior—avoiding execution in former Soviet, CIS-linked, and select Middle Eastern countries—suggests operators may be based in or seek to avoid prosecution from those regions, a common pattern among Eastern European ransomware groups.

TTPs (Tactics, Techniques, Procedures)

DeadLock employs double extortion tactics (T1486 Data Encrypted for Impact, T1567 Exfiltration Over Web Service). Pre-encryption activities include defense evasion via XOR-encoded configuration decryption, language-based geofencing checks (T1614 System Location Discovery), and UAC bypass attempts using batch scripts with ShellExecuteW and the RunAs verb (T1548.002 Bypass User Account Control). The encryptor terminates processes and services to unlock files for encryption (T1489 Service Stop, T1562.001 Impair Defenses: Disable or Modify Tools). It uses Rust-based encryption with embedded public keys and implements resource-aware throttling to maintain system responsiveness during encryption. Post-encryption, it deploys text and HTML ransom notes and establishes decentralized recovery chat infrastructure. The malware avoids encrypting specific file extensions, directories, and sub-paths to preserve system functionality.

Targets & Patterns

As of July 2026, DeadLock operators have published over 80 compromised organizations on their data leak site, with more than half located in Europe. Impacted sectors include information technology, mining, transportation and logistics, manufacturing, hospitality, and consumer goods. Geographic distribution spans Europe, Asia, North America, South America, and Africa. The broad sectoral and geographic targeting suggests an opportunistic approach typical of financially motivated ransomware operations, with no evidence of sector-specific or strategic targeting. The high concentration of European victims may reflect affiliate access patterns or regional vulnerability exposure rather than deliberate targeting strategy.

Historical Context

DeadLock ransomware emerged in July 2025 and represents an evolution in ransomware operational resilience through its adoption of decentralized infrastructure. Microsoft Threat Intelligence has observed deployment by affiliates of established ransomware ecosystems including Lynx and INC, indicating integration into existing RaaS distribution networks. The use of Session messaging and blockchain-backed services for leak hosting and negotiations reflects a trend among ransomware operators to increase infrastructure resilience against takedown efforts, building on lessons learned from law enforcement disruptions of centralized ransomware infrastructure in prior years. The malware's Rust-based implementation aligns with a broader industry shift toward memory-safe languages for malware development, following similar trends observed in other modern ransomware families.

Defensive Recommendations

  • Monitor for UAC bypass attempts via ShellExecuteW with RunAs verb and randomly named .cmd batch scripts (T1548.002); correlate with Sysmon Event ID 1 for process creation and Event ID 10 for process access
  • Detect abnormal service termination patterns (T1489) and process kills targeting backup, security, and database applications; alert on rapid sequential service stop commands via sc.exe or PowerShell
  • Implement application control policies to block execution of unsigned or untrusted Rust-compiled binaries, particularly those exhibiting file encryption behaviors or XOR decryption routines
  • Monitor for mass file modification events with entropy analysis to detect encryption activity (T1486); establish baselines for normal file change rates and alert on anomalies
  • Block outbound connections to Session messaging network nodes and known blockchain-backed hosting services used for ransomware negotiations; inspect DNS queries for decentralized infrastructure indicators