Do Son 
HTML recovery chat infrastructure summary | Image: Microsoft
At a glance
- Malware family: DeadLock
- Threat actor: Multiple criminal affiliates, including Lynx and INC associates
- Target or victims: Over 80 organizations in IT, mining, logistics, manufacturing, and hospitality
- Delivery vector: Under investigation (affiliate-driven access)
- Key capabilities: Intermittent encryption, blockchain storage, Session chat, event log wiping
- Source: Microsoft Threat Intelligence
TL;DR
Microsoft Threat Intelligence tracks DeadLock ransomware as a dangerous double extortion threat. Specifically, the malware combines modern file locking with decentralized blockchain and messaging networks. Operators have already claimed more than 80 victim organizations across the world.
Delivery
Security researchers first detected DeadLock activity in July 2025. Currently, multiple cybercrime groups deploy this malware in the wild. Affiliated actors linked to the Lynx and INC syndicates actively distribute the payloads. These operators target many industries, including information technology, logistics, manufacturing, and mining. Over half of the confirmed victims operate within European countries. However, attackers also struck entities in Asia, Africa, North America, and South America. Sourced reports confirm that the operators demand ransoms while threatening to publish stolen records online.
Infection chain
When launched, the DeadLock ransomware encryptor executes several pre-encryption routines. First, it decrypts an internal configuration blob using an 8-byte XOR key. The binary then checks the system language settings. If it detects languages from the Commonwealth of Independent States or select Middle Eastern regions, it terminates. Otherwise, the program attempts to escalate user rights through a batch script retry loop.
Once elevated, the malware enables several sensitive user privileges, such as SeDebugPrivilege and SeTakeOwnershipPrivilege. In addition, it terminates security processes and disables critical services. For instance, it stops Windows Defender, Volume Shadow Copy, and Active Directory services. The program also clears all Windows event logs through direct API calls and registry changes. As a result, this wiping prevents forensic investigators from analyzing initial activity.
Next, the malware begins file processing. “The DeadLock encryptor includes a resource-aware throttling mechanism designed to maintain system responsiveness during encryption,” reads the report. It monitors CPU and memory loads continually before dispatching new files. If memory usage exceeds 29 percent or CPU usage passes 70 percent, the thread pauses. This careful pacing prevents system freezes and evades defensive monitoring.
For encryption, the program combines Curve25519 elliptic-curve cryptography with the XChaCha20 stream cipher. It uses an intermittent encryption model based on file size. Consequently, large files receive partial encryption at regular intervals, which speeds up the attack. Finally, it renames files with the .dlock extension and drops custom desktop icons.
Command-and-control and data-exfiltration behaviour
The threat group distinguishes itself through its communication infrastructure. “Its recovery ecosystem combines the Session messaging network with blockchain-backed services that store and deliver resources used throughout the extortion process,” the report notes. This modern architecture ensures that operations stay online even during server takedowns.
Specifically, the ransomware drops an interactive HTML application onto victim endpoints. This single-page application acts as an end-to-end encrypted recovery chat. It retrieves proxy configuration data directly from the Polygon blockchain. By using smart contracts, the attackers update routing links without altering local files.
Furthermore, victim communications route through the Session decentralized messenger network. The system derives victim keys deterministically from their access credentials. Meanwhile, the operators store stolen enterprise data on Wasabi cloud storage. The interactive HTML file includes an AWS S3-compatible browser. Therefore, this feature allows victims to view exfiltrated files directly in their web browser.
Defense or detection guidance
Ultimately, defenders must implement multi-layered safeguards against DeadLock ransomware. Security teams should monitor endpoints for unusual batch scripts attempting repeated privilege elevation. Track sudden terminations of defensive services like Volume Shadow Copy.
Moreover, organizations should alert on event log clearing activities and registry modifications under the WINEVT path. Network administrators must monitor traffic to public blockchain RPC nodes from untrusted hosts. Finally, maintain isolated offline backups and enforce multi-factor authentication across all external access portals.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
