DeadLock Ransomware Emerges with Decentralized Infrastructure and Rust Encryption
Microsoft details DeadLock, a Rust-based ransomware employing decentralized communication and blockchain services for its operations, impacting over 80 organizations globally.
Microsoft Threat Intelligence has identified a new financially motivated ransomware operation dubbed DeadLock, notable for its sophisticated use of decentralized infrastructure. This ransomware leverages the Session messaging network and blockchain-based services to manage victim communications, data exfiltration, and extortion processes, aiming for increased operational resilience against disruption efforts.
First observed in July 2025, DeadLock employs a double extortion strategy, encrypting victim data while threatening to publish exfiltrated information on its data leak site, the "DeadLock blog." As of July 2026, the group has claimed responsibility for compromising over 80 organizations worldwide, with a significant concentration of victims in Europe. The ransomware has impacted a diverse range of sectors, including IT, mining, transportation, manufacturing, and hospitality, across multiple continents.
The DeadLock encryptor incorporates several advanced features. It includes a resource-aware throttling mechanism to maintain system performance during the encryption process. Furthermore, it exhibits language-based geofencing, designed to avoid execution in environments associated with former Soviet states, certain Middle Eastern countries, and other specified regions, a common tactic among ransomware operators from these areas.
Technically, the ransomware begins by decrypting an embedded configuration blob using XOR decoding. This configuration contains crucial parameters such as the malware's public key, encryption rules, and lists of files, directories, processes, and languages to exclude. The language exclusion list is particularly interesting, as the malware will self-delete if the system's default or UI language matches any of the specified IDs, preventing execution in targeted regions.
DeadLock also exhibits adaptive command-line processing and privilege escalation attempts. If a target directory is provided, it bypasses preparation steps and proceeds directly to encryption. In instances where the process is not already elevated, the malware attempts to gain administrator privileges using a batch-script-based technique that triggers the Windows User Account Control (UAC) prompt. This feature, however, requires user interaction or prior elevation for full functionality.
The ransomware's encryption process is designed to be efficient, with configurable rules determining the extent of encryption. Post-encryption, it deploys ransom notes and an interactive HTML/JavaScript recovery chat page, further integrating its decentralized infrastructure into the victim interaction process. This recovery chat system, hosted via Session and potentially blockchain services, provides a resilient channel for victims to negotiate with the operators.
Microsoft has observed DeadLock operating as an affiliate of other ransomware ecosystems, including those linked to Lynx and INC. This suggests a potential expansion of the ransomware-as-a-service (RaaS) model, where DeadLock's unique infrastructure and encryption capabilities are being offered to multiple threat actor groups.
Defending against DeadLock requires a multi-layered security approach. Organizations should focus on robust endpoint detection and response (EDR) solutions, regular backups, network segmentation, and prompt patching of vulnerabilities. Additionally, monitoring for the specific indicators of compromise (IOCs) detailed by Microsoft, such as network connections to Session or blockchain services, and the presence of DeadLock's ransom notes, is crucial for early detection and mitigation.