Full Report
The DeadLock ransomware operation is using a decentralized infrastructure that relies on blockchain-backed services to protect its communication with victims and data-leak activity. [...]
Analysis Summary
# Tool/Technique: DeadLock Ransomware
## Overview
DeadLock is a sophisticated ransomware-as-a-service (RaaS) operation that emerged in mid-2025. It is characterized by its use of a decentralized, blockchain-backed infrastructure to resist law enforcement takedowns and maintain persistent communication with victims. The operation employs double-extortion tactics, combining file encryption with data theft and leak site publication.
## Technical Details
- **Type:** Malware family (Ransomware)
- **Platform:** Windows (Rust-based encryptor)
- **Capabilities:** Decentralized C2 retrieval, selective directory encryption, intermittent encryption for large files, shadow copy deletion, anti-CIS/Middle East geofencing.
- **First Seen:** Mid-2025
## MITRE ATT&CK Mapping
- **[TA0040 - Impact]**
- [T1486 - Data Encrypted for Impact]
- [T1490 - Inhibit System Recovery]
- **[TA0011 - Command and Control]**
- [T1102.001 - Web Service: Dead Drop Resolver] (Blockchain Smart Contracts)
- [T1090 - Proxy] (Custom chat proxies)
- **[TA0007 - Discovery]**
- [T1614.001 - System Location Discovery: System Language Locations]
- **[TA0010 - Exfiltration]**
- [T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage] (Wasabi)
## Functionality
### Core Capabilities
- **Decentralized Infrastructure:** Uses the Polygon blockchain and smart contracts (via `eth_call`) to store and retrieve the current IP addresses of chat proxies, allowing operators to rotate infrastructure without updating the malware.
- **Encryption Scheme:** Utilizes **XChaCha20** for file encryption, with keys protected by **Curve25519** elliptic curve cryptography.
- **Intermittent Encryption:** To maximize speed, the malware encrypts 512-byte blocks of larger files rather than the entire file.
- **Resource Management:** Hardcoded limits (29% memory, 70% CPU) ensure the system remains functional during encryption, preventing early detection due to system crashes or extreme lag.
- **System Preparation:** Automatically deletes backups, stops virtualization services, and empties the Recycle Bin to prevent easy recovery.
### Advanced Features
- **Geofencing:** Specifically avoids targets in the Commonwealth of Independent States (CIS), Iran, Syria, Oman, and Yemen.
- **Session Network Integration:** Leverages the decentralized Session network for encrypted victim-actor communications.
- **Cloud-Based Leaks:** Uses Wasabi cloud services to host exfiltrated data.
- **Visual Modification:** Changes desktop wallpapers and file icons to provide immediate visual confirmation of the infection.
## Indicators of Compromise
- **File Extensions:** `.dlock` (appended with a victim-specific identifier).
- **File Names:** `[random_6]_README.txt` (Ransom note).
- **Network Indicators:**
- `polygon-rpc[.]com` (or other public Polygon RPC endpoints).
- `wasabisys[.]com` (Associated with data exfiltration/hosting).
- Session network traffic.
- **Behavioral Indicators:**
- Unauthorized use of `vssadmin.exe` to delete shadow copies.
- Unusual CPU/Memory spikes pinned at specific thresholds (70%/29%).
- Execution of WMI or PsExec for lateral movement during deployment.
## Associated Threat Actors
- **Ransomware Affiliates:** Groups previously linked to the **Lynx** and **INC** ransomware ecosystems.
## Detection Methods
- **Signature-based:** Detection of the Rust-based encryptor binary and specific ransom note naming conventions.
- **Behavioral:**
- Monitoring for `eth_call` queries to blockchain smart contracts from non-browser processes.
- Identifying the deletion of Volume Shadow Copies (`vssadmin delete shadows`).
- Detection of high-volume file renaming operations to the `.dlock` extension.
- **EDR/Block Mode:** Using EDR solutions to identify and block the encryption process based on file entropy changes and resource throttling patterns.
## Mitigation Strategies
- **Endpoint Protection:** Enable EDR in "Block Mode" and activate "Tamper Protection."
- **Controlled Folder Access:** Restrict unauthorized applications from modifying files in critical directories.
- **Attack Surface Reduction (ASR):** Implement rules to block PsExec and WMI commands often used for lateral movement.
- **Network Filtering:** Monitor or restrict access to public blockchain RPC endpoints if not required for business operations.
- **Offline Backups:** Maintain immutable, off-site backups to counter the deletion of local shadow copies.
## Related Tools/Techniques
- **EtherHiding:** A similar technique used by North Korean actors to hide malicious scripts on the blockchain.
- **Lynx/INC Ransomware:** Shared affiliate infrastructure and deployment TTPs.
- **Wasabi Cloud:** Common legitimate service abused for data exfiltration storage.