CTI · corroborated · 2026-08-13

DeadLock ransomware uses blockchain to resist infrastructure takedown

Full story & timeline

MITRE ATT&CK

• T1486 Data Encrypted for Impact Impact
• T1490 Inhibit System Recovery Impact
• T1562 Impair Defenses Stealth
• T1070 Indicator Removal Stealth
• T1489 Service Stop Impact
• T1548 Abuse Elevation Control Mechanism Privilege Escalation

Indicators

No curated indicators tied to this case.

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: DeadLock Ransomware Encrypted File and Ransom Note Artifacts
id: 0ad67621-8d62-4f84-9824-fdfabea69c2a
status: experimental
description: >
    Detects file artifacts documented for DeadLock ransomware (Microsoft
    Threat Intelligence, Aug 2026): files renamed with the .dlock extension,
    text ransom notes named HOW_RECOVER.<UID>.txt dropped per encrypted
    directory, and the self-contained HTML recovery chat
    RECOVERY_CHAT.<UID>.html dropped to drive roots and Desktop folders.
references:
    - https://www.microsoft.com/en-us/security/blog/2026/08/10/deadlock-ransomware-breaking-down-a-rust-based-encryptor-with-decentralized-recovery-infrastructure/
    - https://www.bleepingcomputer.com/news/security/deadlock-ransomware-uses-blockchain-to-resist-infrastructure-takedown/
author: Tia N. List
date: 2026/08/13
tags:
    - attack.t1486
    - attack.t1490
    - attack.t1070
logsource:
    category: file_event
    product: windows
detection:
    selection_dlock:
        TargetFilename|endswith: '.dlock'
    selection_note_txt:
        TargetFilename|contains: 'HOW_RECOVER.'
        TargetFilename|endswith: '.txt'
    selection_note_html:
        TargetFilename|contains: 'RECOVERY_CHAT.'
        TargetFilename|endswith: '.html'
    condition: selection_dlock or selection_note_txt or selection_note_html
falsepositives:
    - Files legitimately using a .dlock extension outside this campaign (rare); corroborate with encryption behavior and ransom notes
    - Development or decoy files named HOW_RECOVER/RECOVERY_CHAT; validate against adjacent encryption activity
level: high
---
title: DeadLock Ransomware Leak Site Network Connections
id: a52e6fef-dffc-4807-a0f6-251ae44a95a4
status: experimental
description: >
    Detects network connections to DeadLock ransomware leak-site domains
    published as indicators of compromise by Microsoft Threat Intelligence:
    deadlock.liveblog365.com, dlock.liveblog365.com,
    deadlockblog.great-site.net and deadlockblog.medianewsonline.com,
    plus the .onion mirror deadblogdbdu5wprek7wa2o4ce7rnt6u6ntqeud3hzjjcveosgpsqqqd.
references:
    - https://www.microsoft.com/en-us/security/blog/2026/08/10/deadlock-ransomware-breaking-down-a-rust-based-encryptor-with-decentralized-recovery-infrastructure/
    - https://www.bleepingcomputer.com/news/security/deadlock-ransomware-uses-blockchain-to-resist-infrastructure-takedown/
author: Tia N. List
date: 2026/08/13
tags:
    - attack.t1486
    - attack.t1562
    - attack.t1070
logsource:
    category: network_connection
    product: windows
detection:
    selection_domains:
        DestinationHostname|endswith:
            - 'deadlock.liveblog365.com'
            - 'dlock.liveblog365.com'
            - 'deadlockblog.great-site.net'
            - 'deadlockblog.medianewsonline.com'
    selection_onion:
        DestinationHostname|contains: 'deadblogdbdu5wprek7wa2o4ce7rnt6u6ntqeud3hzjjcveosgpsqqqd'
    condition: 1 of selection_*
falsepositives:
    - None known; these domains are unique to the DeadLock leak-site infrastructure and are not legitimate services
level: high

Splunk SPL raw

# deadlock-ransomware-uses-blockchain-to-resist-infrastructure-tak — Splunk SPL variant (derived from deadlock-ransomware-uses-blockchain-to-resist-infrastructure-tak.sigma via sigma convert)
# source-sha256: b9acc849e6a8f490cd1514eddacd4d682f5e549829374dc2d25a4ad801d35816 v1
TargetFilename="*.dlock" OR (TargetFilename="*HOW_RECOVER.*" TargetFilename="*.txt") OR (TargetFilename="*RECOVERY_CHAT.*" TargetFilename="*.html")

DestinationHostname IN ("*deadlock.liveblog365.com", "*dlock.liveblog365.com", "*deadlockblog.great-site.net", "*deadlockblog.medianewsonline.com") OR DestinationHostname="*deadblogdbdu5wprek7wa2o4ce7rnt6u6ntqeud3hzjjcveosgpsqqqd*"

KQL (Sentinel / Defender) raw

# deadlock-ransomware-uses-blockchain-to-resist-infrastructure-tak — KQL variant (derived from deadlock-ransomware-uses-blockchain-to-resist-infrastructure-tak.sigma via sigma convert)
# source-sha256: b9acc849e6a8f490cd1514eddacd4d682f5e549829374dc2d25a4ad801d35816 v1
TargetFilename endswith ".dlock" or (TargetFilename contains "HOW_RECOVER." and TargetFilename endswith ".txt") or (TargetFilename contains "RECOVERY_CHAT." and TargetFilename endswith ".html")

(DestinationHostname endswith "deadlock.liveblog365.com" or DestinationHostname endswith "dlock.liveblog365.com" or DestinationHostname endswith "deadlockblog.great-site.net" or DestinationHostname endswith "deadlockblog.medianewsonline.com") or DestinationHostname contains "deadblogdbdu5wprek7wa2o4ce7rnt6u6ntqeud3hzjjcveosgpsqqqd"

YARA-X raw

rule DeadLock_Ransomware_Encryptor_Artifacts {
    meta:
        author = "Tia N. List"
        date = "2026-08-13"
        status = "experimental"
        description = "DeadLock ransomware (Rust-based encryptor, first observed July 2025, Microsoft Threat Intelligence Aug 2026): the dDlK footer magic embedded in encrypted files, the .dlock encrypted-file extension, the HOW_RECOVER text ransom note and RECOVERY_CHAT HTML recovery-chat names, and the leak-site domain family. Derived from Microsoft Threat Intelligence case analysis — NOT validated against a live sample."
        reference = "https://www.microsoft.com/en-us/security/blog/2026/08/10/deadlock-ransomware-breaking-down-a-rust-based-encryptor-with-decentralized-recovery-infrastructure/"
        falsepositives = "The .dlock extension and HOW_RECOVER/RECOVERY_CHAT note names are unique to DeadLock; dDlK magic and the leak domains are distinctive. Require the PE context plus at least two of the documented strings and corroborate with file/network telemetry"
    strings:
        $magic = "dDlK" ascii
        $ext = ".dlock" ascii nocase
        $note_txt = "HOW_RECOVER" ascii
        $note_html = "RECOVERY_CHAT" ascii
        $leak1 = "liveblog365.com" ascii nocase
        $leak2 = "deadlockblog" ascii nocase
    condition:
        uint16(0) == 0x5A4D and 2 of them
}

References

• https://www.bleepingcomputer.com/news/security/deadlock-ransomware-uses-blockchain-to-resist-infrastructure-takedown/
• https://www.microsoft.com/en-us/security/blog/2026/08/10/deadlock-ransomware-breaking-down-a-rust-based-encryptor-with-decentralized-recovery-infrastructure/
• https://cyberpress.org/deadlock-steals-encrypts-extorts/
• https://gbhackers.com/deadlock-ransomware-attack/