Reported by 6 outlets

Timeline

1. update from microsoft.com

   DeadLock ransomware: Breaking down a Rust-based encryptor with decentralized recovery infrastructure

   microsoft.com · 64d ago · August 10th, 2026

   In this article Pre-encryption Encryption Post-encryption Defending against DeadLock ransomware Indicators of compromise Microsoft Threat Intelligence tracks DeadLock ransomware as an emerging financially motivated operation distinguished by its use of decentralized infrastructure to support victim communications and data leak operations. Its recovery ecosystem combines the Session messaging network with blockchain-backed services that store and deliver resources used throughout the extortion process. This architecture likely increases the resilience of portions of its communication, leak-hosting, and negotiation infrastructure, allowing DeadLock operators to recover from some disruption efforts while maintaining continuity for victims. Microsoft has observed DeadLock ransomware being deployed by multiple groups including an affiliate of the Lynx and INC ransomware ecosystems. First observed in July 2025, DeadLock operators employ double extortion tactics, encrypting victim environments while threatening to publicly release exfiltrated data. As of July 2026, the operators have published more than 80 compromised organizations on their data leak site, called the DeadLock blog, with more than half of the claimed victims in Europe. Microsoft identified DeadLock ransomware impacting organizations across information technology (IT), mining, transportation and logistics, manufacturing, hospitality, consumer goods, and other sectors in Europe, Asia, North America, South America, and

2. mentioned by malware.news

   DeadLock ransomware: Breaking down a Rust-based encryptor with decentralized recovery infrastructure

   malware.news · 64d ago · August 10th, 2026

3. update from microsoft.com

   DeadLock Ransomware: Rust Encryptor With Decentralized Recovery Infrastructure

   microsoft.com · 64d ago · August 11th, 2026

   The Rust-based encryptor's pre-encryption routine disables Windows Defender, deletes backups, and clears event logs; it also geofences against Russian, Ukrainian, Belarusian, and several CIS languages plus Iran, Syria, Oman, and Yemen, deleting itself in those locales.

4. update from gbhackers.com

   DeadLock Ransomware Disables Windows Defender, Backups and Event Logs Before Encrypting Files

   gbhackers.com · 63d ago · August 11th, 2026

   DeadLock, an emerging financially motivated ransomware operation that couples conventional intrusion tradecraft with decentralized infrastructure engineered to survive disruption. The encryptor’s pre-encryption routine is built to degrade both prevention and recovery. After XOR-decoding an embedded configuration, DeadLock checks default and UI language identifiers and deletes itself when it detects Russian, Ukrainian, Belarusian, several CIS languages, Iran, Syria, Oman or Yemen. This geofencing is not attribution, but is consistent with a regional avoidance pattern. On systems without elevation, the Rust-based malware generates a randomly named CMD file and repeatedly invokes ShellExecuteW with RunAs, attempting to force a UAC approval. Elevated execution unlocks SeDebugPrivilege, SeBackupPrivilege, SeRestorePrivilege, SeTakeOwnershipPrivilege and related privileges. DeadLock then empties Recycle Bins, registers a custom icon for its .dlock extension, and stops processes and services likely to impede encryption. Windows Defender’s windefend service, VSS, Windows Backup, Hyper-V components and Active Directory services are among the listed targets. The process kill list includes MsMpEng, SmartScreen, cloud-sync clients, backup software, remote-access utilities, PowerShell, Task Manager and Explorer. The intent is dual-purpose: release

5. update from cyberpress.org

   DeadLock Steals Corporate Data Before Encrypting Systems and Threatening Public Leaks

   cyberpress.org · 63d ago · August 11th, 2026

   The operation follows the familiar double-extortion model: attackers first steal sensitive information, then lock files and use the threat of a public data leak to increase pressure on victims. What makes DeadLock notable is its decentralized infrastructure. Instead of depending entirely on traditional websites and servers that law enforcement or hosting providers can disrupt, the ransomware uses blockchain-backed services and the Session messaging network to support negotiation, leak publication, and victim communication. DeadLock Steals Encrypts Extorts The DeadLock encryptor is written in Rust and begins by decoding an embedded configuration file with an XOR key . This configuration includes the victim ID, attacker public key, lists of processes and services to stop, excluded files and directories, ransom-note content, and geofencing settings. It exits and deletes itself

6. update from bleepingcomputer.com

   DeadLock ransomware uses blockchain to resist infrastructure takedown

   bleepingcomputer.com · 63d ago · August 11th, 2026

   Instead of using a traditional Tor URL, the HTML page retrieves the current chat-proxy address by querying a smart contract on the Polygon blockchain through a read-only eth_call . DeadLock's HTML chat app Source: Microsoft Retrieving command-and-control (C2) addresses stored on the blockchain is now a common tactic for cybercriminals, but it is a rare occurrence in the ransomware space. Additionally, DeadLock uses the decentralized Session network to encrypt victim communications and provides access to stolen files hosted on the Wasabi cloud service. All that enables the operators to replace the chat proxy without modifying the vic

7. update from socfortress.medium.com

   DeadLock Ransomware: Analysis of Rust Encryption and Decentralized Recovery

   socfortress.medium.com · 60d ago · August 14th, 2026

   Architectural Overview and Threat Context The emergence of DeadLock ransomware signifies a strategic shift toward high-performance, memory-safe malware development coupled with unprecedented infrastructure resilience. Developed in Rust , the DeadLock encryptor leverages the language’s inherent efficiency and modularity to bypass traditional signature-based detection while providing a robust cross-platform foundation. Central to its threat profile is its departure from traditional centralized command-and-control (C2) models; instead, DeadLock utilizes a decentralized recovery architecture involving Web3 technologies and onion-routed messaging. This design philosophy is specifically engineered to ensure operational continuity, allowing the threat actors to maintain extortion workflows even in the face of infrastructure seizures or domain takedowns. First identified in July 2025, DeadLock operates under a double-extortion model, exfiltrating sensitive data before deploying its cryptographic payload. As of mid-2026, the group’s “DeadLock blog” has listed over 80 victims, with a heavy concentration (over 50%) in Europe. The threat is sector-agnostic, having compromised organizations in IT, manufacturing, mining, transportation, and hospitality across nearly every continent. Core Design Philosophies Rust-Based Moderniza