Actor Profile

DeadLock is a ransomware-as-a-service (RaaS) operation that emerged in mid-2025, employing double-extortion tactics combining data theft with file encryption. The operation is decentralized, with Microsoft observing deployment by multiple affiliate groups, including at least one actor previously linked to the Lynx and INC ransomware ecosystems. The operators demonstrate advanced technical sophistication through their adoption of blockchain-backed infrastructure to resist law enforcement disruption. By July 2026, the operation had compromised approximately 80 organizations, predominantly in Europe. The malware is configured to avoid systems in former Soviet Union countries, the Commonwealth of Independent States (CIS) region, Iran, Syria, Oman, and Yemen, suggesting operators likely originate from or maintain ties to these regions.

TTPs (Tactics, Techniques, Procedures)

DeadLock employs a multi-stage attack chain beginning with initial access through undisclosed vectors, followed by credential-based lateral movement. Pre-encryption preparation includes deleting backups (T1490 - Inhibit System Recovery), stopping virtualization services, and emptying the Recycle Bin. The ransomware uses XChaCha20 encryption with Curve25519 elliptic curve cryptography for key protection (T1486 - Data Encrypted for Impact), applying intermittent 512-byte block encryption to larger files for speed. Command-and-control infrastructure leverages the Polygon blockchain for configuration storage via smart contract queries (T1102 - Web Service), the decentralized Session network for victim communications (T1573 - Encrypted Channel), and Wasabi cloud service for exfiltrated data hosting (T1567 - Exfiltration Over Web Service). The malware is resource-throttled to use maximum 29% memory and 70% CPU to maintain system usability during encryption. Ransom demands are made in Bitcoin or Monero (T1657 - Financial Theft).

Targets & Patterns

DeadLock primarily targets organizations in Europe, with victims spanning IT, mining, transportation, manufacturing, hospitality, and consumer goods sectors. The broad sectoral targeting suggests an opportunistic victim selection model typical of RaaS operations, where affiliates choose targets based on perceived ability to pay rather than strategic intelligence objectives. The geographic concentration in Europe may reflect affiliate distribution or initial access broker relationships rather than deliberate strategic focus. The operation's double-extortion model and data leak site indicate targeting of organizations with sensitive data and reputational concerns that increase pressure to pay ransoms. The multi-affiliate structure means targeting patterns may vary by individual threat actor, with at least one affiliate bringing experience from previous Lynx and INC ransomware campaigns.

Historical Context

DeadLock emerged in mid-2025 as part of the evolving ransomware ecosystem following disruptions to established operations. Microsoft identified at least one affiliate with prior links to the Lynx and INC ransomware ecosystems, indicating continuity of personnel across different RaaS platforms—a common pattern as operators migrate between services following law enforcement actions or operational changes. The adoption of blockchain-based C2 infrastructure represents an evolution in ransomware resilience tactics; while blockchain-stored C2 addresses are increasingly common among cybercriminals, DeadLock's implementation is noted as rare within the ransomware space specifically. The operation's growth to 80 victims within approximately one year demonstrates rapid scaling typical of successful RaaS models. The decentralized infrastructure approach appears to be a direct response to increased law enforcement takedown capabilities targeting traditional Tor-based ransomware infrastructure.

Defensive Recommendations

  • Deploy cloud-delivered antivirus with EDR in block mode, enable tamper protection, and configure automated investigation and remediation to detect and disrupt ransomware execution before encryption begins
  • Enable Controlled Folder Access to restrict unauthorized file modifications and implement attack-surface reduction (ASR) rules to block untrusted executables and lateral movement via PsExec and WMI (T1570)
  • Monitor for backup deletion activity (T1490) including vssadmin, wbadmin, and bcdedit commands, and implement immutable backup solutions with offline or air-gapped copies to ensure recovery capability
  • Implement network monitoring for unusual blockchain RPC endpoint queries (Polygon eth_call traffic) and connections to decentralized networks like Session, which may indicate DeadLock C2 communication
  • Enforce strong credential hygiene and multi-factor authentication across all accounts, as post-compromise activity using valid credentials significantly reduces prevention effectiveness (37% block rate per Microsoft data)