Full Report
The ransomware group known as DeadLock has been observed using decentralized infrastructure to facilitate victim communications and data leak operations in a bid to improve operational resilience. "Its recovery ecosystem combines the Session messaging network with blockchain-backed services that store and deliver resources used throughout the extortion process," the Microsoft Threat
Analysis Summary
# Threat Actor: DeadLock
## Attribution & Identity
- **Actor Name:** DeadLock
- **Aliases:** None identified, though associated with a Rust-based encryptor.
- **Known Associations:** Observed being deployed by affiliates associated with **Lynx** and **INC Ransomware**. It is noted for not having a traditional public affiliate program or a centralized data leak site (DLS).
## Activity Summary
DeadLock was first detected in July 2025. It employs a "double extortion" model, where it both encrypts data and threatens to leak exfiltrated information. As of August 2026, the group has claimed approximately 96 victims. The group is notable for its use of decentralized infrastructure (blockchain and P2P messaging) to evade traditional takedown efforts.
## Tactics, Techniques & Procedures
- **Double Extortion:** Encrypting files while exfiltrating data for leverage.
- **Selective Encryption:** Excludes specific directories and file extensions to maintain system stability.
- **Cryptographic Scheme:** Uses a hybrid design of **Curve25519** (ECC) and **XChaCha20** (Stream cipher).
- **Geofencing:** Specifically avoids execution in CIS (former Soviet) and select Middle Eastern countries.
- **Resource Throttling:** Pauses encryption if memory usage exceeds 29% or CPU load exceeds 70% to remain stealthy and keep the system responsive.
- **Defense Evasion:**
- Systematic erasure of Windows event logs.
- Registry manipulation to disable future logging.
- PowerShell scripts to stop non-allowlisted services.
- Deletion of Volume Shadow Copies.
- Self-deleting batch scripts to remove the ransomware binary post-encryption.
- **Custom Indicators:** Changes file extensions to `.dlock` and applies a custom `.ico` file to encrypted files.
## Targeting
- **Sectors:** Not limited to specific sectors, but focus is on organizations capable of paying high ransoms.
- **Geography:** Primarily Italy, Spain, Poland, Türkiye, and the United States.
- **Victims:** 96 claimed victims as of August 2026.
## Tools & Infrastructure
- **Malware:** DeadLock (Rust-based ransomware).
- **Remote Access:** **AnyDesk** for remote control of compromised hosts.
- **Communications:**
- **Session:** A decentralized, end-to-end encrypted messaging app.
- **Interactive HTML Note:** `RECOVERY_CHAT..html` dropped in root directories, functioning as a standalone web app for chat and data browsing.
- **Blockchain Infrastructure:** Uses **Polygon Smart Contracts** to manage and retrieve backend proxy server details for victim communications.
- **Payments:** Accepts **Bitcoin (BTC)** and **Monero (XMR)**.
## Implications
DeadLock represents a shift toward "resilient extortion." By moving their communication and leak infrastructure away from centralized web servers and onto the Polygon blockchain and Session P2P network, they make it significantly harder for law enforcement to seize domains or "null-route" their operations. The use of Rust and resource-aware throttling suggests a sophisticated development cycle focused on evasion and reliability.
## Mitigations
- **Monitor for AnyDesk:** Implement strict application allowlisting to prevent unauthorized remote desktop tools like AnyDesk.
- **Shadow Copy Protection:** Use file integrity monitoring to alert on the deletion of Volume Shadow Copies (vssadmin.exe usage).
- **Log Integrity:** Forward logs to a centralized, write-only SIEM to ensure that even if local logs are cleared, the trail remains.
- **Block Known Infrastructure:** Monitor for traffic related to the Session messenger protocol and Polygon RPC nodes if they are not required for business operations.
- **Backup Strategy:** Maintain offline, immutable backups to counter the deletion of online backups and shadow copies.