DeadLock Steals Corporate Data Before Encrypting Systems and Threatening Public Leaks

First seen in July 2025, the group has already listed more than 80 organizations on its leak site, known as the DeadLock blog.

More than half of the claimed victims are located in Europe, but attacks have also affected organizations across Asia, North America, South America, and Africa.

Targeted sectors include IT, mining, manufacturing, transportation, logistics, hospitality, and consumer goods.

DeadLock has also been linked to multiple cybercriminal groups, including an affiliate associated with the Lynx and INC ransomware ecosystems.

The operation follows the familiar double-extortion model: attackers first steal sensitive information, then lock files and use the threat of a public data leak to increase pressure on victims.

What makes DeadLock notable is its decentralized infrastructure.

Instead of depending entirely on traditional websites and servers that law enforcement or hosting providers can disrupt, the ransomware uses blockchain-backed services and the Session messaging network to support negotiation, leak publication, and victim communication.

DeadLock Steals Encrypts Extorts

The DeadLock encryptor is written in Rust and begins by decoding an embedded configuration file with an XOR key.

This configuration includes the victim ID, attacker public key, lists of processes and services to stop, excluded files and directories, ransom-note content, and geofencing settings.

Before encrypting files, DeadLock checks the victim system language.

It exits and deletes itself if it detects languages associated with Russia, Ukraine, Belarus, several Commonwealth of Independent States countries, Iran, Syria, Oman, or Yemen. This type of geofencing is commonly used by ransomware operators seeking to avoid systems in certain regions.

If the malware is not running with administrator privileges, it attempts to trigger a Windows User Account Control prompt using a randomly named batch file.

When elevated, it enables powerful Windows privileges, including SeDebugPrivilege, SeBackupPrivilege, SeRestorePrivilege, and SeTakeOwnershipPrivilege. These permissions help it access protected files and interfere with security tools.

DeadLock then targets security, backup, cloud-storage, remote-access, and system-management processes.

It attempts to stop Windows Defender, Volume Shadow Copy, backup services, Hyper-V services, Active Directory-related services, OneDrive, Dropbox, Google Drive, AnyDesk, PowerShell, Task Manager, and other tools that could block encryption or support recovery.

The ransomware also clears Windows event logs, disables future logging through registry changes, and modifies access permissions for log channels.

This combination can make incident response and forensic investigation harder.

For encryption, DeadLock uses XChaCha20 for file content and Curve25519-based key exchange to protect each file’s encryption key.

Each targeted file receives a unique cryptographic key, making recovery without the attacker’s private key impractical, microsoft said.

Indicators of Compromise

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN. Gain complete phishing visibility to strengthen your SOC and reduce MTTR