Actor Profile

DeadLock is a ransomware group first detected in July 2025, operating double extortion campaigns that encrypt victim environments and threaten public data release. The group has claimed 96 victims as of August 2026, primarily in Italy, Spain, Poland, Türkiye, and the U.S. DeadLock maintains a lower profile than peers by avoiding known affiliate programs, though Microsoft observed the ransomware deployed by multiple threat actors including affiliates for Lynx and INC ransomware. The group's motivation is financial extortion via Bitcoin or Monero payments, with promises of decryption keys, security reports detailing breach methodology, and assurances against future targeting.

TTPs (Tactics, Techniques, Procedures)

DeadLock employs selective file encryption using Curve25519 elliptic-curve cryptography combined with XChaCha20 stream cipher, appending ".dlock" extensions to encrypted files. Defense evasion techniques include erasing logs via Registry manipulation (T1070.001), deleting Volume Shadow Copies (T1490), and using PowerShell scripts to stop non-allowlisted services (T1059.001). The malware implements resource-aware throttling (pausing at >29% memory or >70% CPU usage) and geofencing to avoid CIS and select Middle Eastern countries. Remote access is maintained via AnyDesk (T1219). Post-encryption cleanup involves batch scripts for self-deletion (T1070.004). The group uses decentralized infrastructure including Session messaging network and Polygon smart contracts for C2 proxy rotation (T1090), making takedown efforts significantly more difficult. An HTML-based recovery chat application provides encrypted victim communications and hosts data leak blogs on blockchain storage via Wasabi protocol.

Targets & Patterns

DeadLock targets organizations across multiple sectors with geographic concentration in Italy, Spain, Poland, Türkiye, and the United States. As of August 2026, the group has claimed 96 victims. The targeting pattern suggests opportunistic victim selection rather than sector-specific focus, though the group explicitly excludes former Soviet and CIS-linked countries as well as select Middle Eastern nations through geofencing mechanisms. This exclusion pattern is consistent with threat actors seeking to avoid law enforcement attention from specific jurisdictions. The group's use of multiple deployment vectors through various affiliates (including those associated with Lynx and INC ransomware) suggests a ransomware-as-a-service or affiliate model, enabling broader victim reach across diverse industries and geographies.

Historical Context

DeadLock was first detected in July 2025, but victims were not publicly identified until late May 2026 according to Ransomware.Live, indicating an initial period of lower visibility. Group-IB analysis from January 2026 noted the group maintained a lower profile than peers due to lack of association with known affiliate programs and absence of a traditional data leak site. By August 2026, Microsoft Threat Intelligence observed the ransomware being deployed by multiple threat actors, including affiliates for Lynx and INC ransomware operations, suggesting evolution toward a multi-actor deployment model. The group's adoption of blockchain-based infrastructure represents a notable evolution in ransomware communication channels, moving beyond traditional Tor-based hidden services to censorship-resistant decentralized platforms. This architectural shift poses new challenges for law enforcement takedown efforts compared to conventional ransomware operations.

Defensive Recommendations

  • Monitor for PowerShell execution stopping multiple services and deleting Volume Shadow Copies (T1059.001, T1490) via Sysmon Event IDs 1 and 4688, particularly scripts targeting vssadmin.exe and wmic.exe
  • Detect Registry modifications targeting event logging configurations (T1070.001) in HKLM\SYSTEM\CurrentControlSet\Services\EventLog and alert on suspicious disabling of audit policies
  • Block or closely monitor AnyDesk and other remote access tools (T1219) not explicitly approved for business use; implement application allowlisting to prevent unauthorized remote control software
  • Implement network monitoring for connections to Polygon blockchain RPC endpoints and unusual JavaScript-based smart contract interactions that may indicate C2 proxy rotation activity (T1090)
  • Deploy behavioral detection for resource-aware encryption patterns, including processes that pause based on CPU/memory thresholds and systematically traverse directories while excluding specific file types