Tia N.List

CTI · reported · 2026-08-11

DeadLock Ransomware: Rust Encryptor With Decentralized Recovery Infrastructure

Full story & timeline

Actors

LynxINC

Malware / tools

DeadLock

Campaigns

—

CVEs

—

Victim sectors

Information technologyMiningManufacturingTransportationLogisticsHospitalityConsumer goods

Geography

EuropeAsiaNorth AmericaSouth America

MITRE ATT&CK

Indicators

No curated indicators tied to this case.

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: DeadLock Ransomware Pre-Encryption Tripwires
id: 3b72e539-2be3-4d9b-bc47-96f5028acb22
status: experimental
description: >
    Detects the pre-encryption tripwires documented for the DeadLock
    ransomware operation (Microsoft Threat Intelligence, 2026-08-10):
    Windows Defender tampering, backup deletion and event log clearing
    that fire before encryption begins.
references:
    - https://www.microsoft.com/en-us/security/blog/2026/08/10/deadlock-ransomware-breaking-down-a-rust-based-encryptor-with-decentralized-recovery-infrastructure/
author: Tia N. List
date: 2026/08/11
tags:
    - attack.t1486
    - attack.t1490
    - attack.t1562
    - attack.t1070
logsource:
    category: process_creation
    product: windows
detection:
    selection_vss:
        Image|endswith: '\vssadmin.exe'
        CommandLine|contains|all:
            - 'delete'
            - 'shadows'
    selection_wbadmin:
        Image|endswith: '\wbadmin.exe'
        CommandLine|contains|all:
            - 'delete'
            - 'backup'
    selection_logs:
        Image|endswith:
            - '\wevtutil.exe'
        CommandLine|contains:
            - 'cl '
            - 'clear-log'
            - 'clear log'
    selection_defender:
        Image|endswith:
            - '\sc.exe'
        CommandLine|contains|all:
            - 'stop'
            - 'WinDefend'
    condition: 1 of selection_*
falsepositives:
    - Legitimate scheduled backup and log maintenance
    - Administer shadow-copy cleanup on busy storage servers
level: high

Splunk SPL raw

# deadlock-ransomware-rust-encryptor-with-decentralized-recovery-i — Splunk SPL variant (derived from deadlock-ransomware-rust-encryptor-with-decentralized-recovery-i.sigma via sigma convert)
# source-sha256: d4d1b676ab6812734e3e7779773f4aa5ac015a95a326aa29db5e97d58d396cfd v1
(Image="*\\vssadmin.exe" CommandLine="*delete*" CommandLine="*shadows*") OR (Image="*\\wbadmin.exe" CommandLine="*delete*" CommandLine="*backup*") OR (Image="*\\wevtutil.exe" CommandLine IN ("*cl *", "*clear-log*", "*clear log*")) OR (Image="*\\sc.exe" CommandLine="*stop*" CommandLine="*WinDefend*")

KQL (Sentinel / Defender) raw

# deadlock-ransomware-rust-encryptor-with-decentralized-recovery-i — KQL variant (derived from deadlock-ransomware-rust-encryptor-with-decentralized-recovery-i.sigma via sigma convert)
# source-sha256: d4d1b676ab6812734e3e7779773f4aa5ac015a95a326aa29db5e97d58d396cfd v1
(Image endswith "\\vssadmin.exe" and (CommandLine contains "delete" and CommandLine contains "shadows")) or (Image endswith "\\wbadmin.exe" and (CommandLine contains "delete" and CommandLine contains "backup")) or (Image endswith "\\wevtutil.exe" and (CommandLine contains "cl " or CommandLine contains "clear-log" or CommandLine contains "clear log")) or (Image endswith "\\sc.exe" and (CommandLine contains "stop" and CommandLine contains "WinDefend"))

YARA-X raw

rule DeadLock_Ransomware {
    meta:
        author = "Tia N. List"
        date = "2026-08-11"
        status = "experimental"
        description = "Rust-based encryptor with decentralized recovery infrastructure. Pre-encryption routine disables Windows Defender, deletes backups, clears event logs; geofences RU/BY/UA/CIS plus IR/SY/OM/YE locales. Derived from case analysis — NOT validated against a live sample."
        reference = "https://www.microsoft.com/en-us/security/blog/2026/08/10/deadlock-ransomware-breaking-down-a-rust-based-encryptor-with-decentralized-recovery-infrastructure/"
        falsepositives = "Legitimate backup/admin tooling bundling the same command strings is possible; treat as a hunting signal, not a verdict"
    strings:
        $vssadmin = "vssadmin" ascii nocase
        $shadows = "delete shadows" ascii nocase
        $wbadmin = "wbadmin" ascii nocase
        $wevtutil = "wevtutil" ascii nocase
        $windefend = "WinDefend" ascii nocase
        $setmp = "Set-MpPreference" ascii nocase
    condition:
        uint16(0) == 0x5A4D and 2 of ($vssadmin, $shadows, $wbadmin, $wevtutil, $windefend, $setmp)
}

References

Source on GitHub