DeadLock ransomware layers decentralized recovery onto extortion
Session messaging and blockchain-backed services make portions of its leak and negotiation infrastructure harder to disrupt, but the hardening is partial, not total.
TL;DR
Microsoft Threat Intelligence published a technical breakdown of DeadLock ransomware August 10. The Rust-based encryptor, active since July 2025, has hit more than 80 organizations across IT, mining, transportation, manufacturing, hospitality, and consumer goods, more than half in Europe. What distinguishes DeadLock is its recovery infrastructure: it combines the Session messaging network with blockchain-backed services to store and deliver resources used throughout extortion, likely hardening portions of its leak and negotiation infrastructure against disruption. The encryptor also throttles to preserve system responsiveness and geofences against systems in former Soviet, CIS, and select Middle Eastern countries.
Microsoft Threat Intelligence published a detailed breakdown of DeadLock ransomware on August 10, tracking it as an emerging financially motivated operation active since July 2025. What distinguishes DeadLock isn't its Rust-based encryptor (several families have made that migration) but its recovery infrastructure: the operation combines the Session messaging network with blockchain-backed services to store and deliver resources used throughout the extortion process.
The architecture likely increases the resilience of portions of DeadLock's communication, leak-hosting, and negotiation infrastructure, Microsoft assesses. Some disruption efforts that would cripple a conventional ransomware operation may not fully disable DeadLock's. The hardening is partial, but it raises the cost of takedown.
DeadLock otherwise follows the established playbook. It's been deployed by multiple groups, including an affiliate of the Lynx and INC ransomware ecosystems. It uses double extortion (encrypt and threaten to leak) and has published more than 80 compromised organizations on its data leak site as of July 2026. Sectors hit include IT, mining, transportation, manufacturing, hospitality, and consumer goods across Europe, Asia, North America, South America, and Africa. The encryptor includes a resource-aware throttling mechanism to maintain system responsiveness during encryption. It also geofences against systems in former Soviet, CIS, and select Middle Eastern countries, a pattern common among ransomware operators believed to operate from those regions.
Microsoft's breakdown includes indicators of compromise, Microsoft Defender detections, and mitigation guidance. The decentralized recovery infrastructure doesn't change the core defense posture, it changes the calculus for disruption operations. Organizations should review the IOCs and ensure detection coverage for the encryptor's behaviors, particularly the configuration parsing and geofencing checks that run before encryption begins.
Published ·Deep Fathom