DeadLock ransomware is an emerging financially motivated threat tracked by Microsoft Threat Intelligence since July 2025. It is distinguished by its use of decentralized infrastructure combining the Session messaging network and blockchain-backed services to support victim communications, data leak hosting, and extortion processes, enhancing resilience against disruption. The ransomware is written in Rust and features resource-aware throttling to reduce system impact during encryption. It implements geofencing based on system language settings to avoid execution in environments linked to former Soviet, CIS, and select Middle Eastern countries. DeadLock operators employ double extortion by encrypting victim environments and threatening data leaks, with over 80 organizations publicly listed as victims by mid-2026. The malware terminates specific processes and services, excludes certain files and directories from encryption, and delivers ransom notes and an interactive recovery chat page. Multiple ransomware groups, including affiliates of Lynx and INC ecosystems, have deployed DeadLock. Microsoft provides comprehensive technical details, detection capabilities, and mitigation recommendations in their security blog.

DeadLock ransomware encrypts victim data, disrupting business operations, and uses double extortion by threatening to publicly release stolen data, increasing pressure on victims to pay ransom. Its decentralized infrastructure improves the attackers' ability to maintain communication and data leak operations despite disruption attempts, potentially prolonging the attack lifecycle. The ransomware's resource-aware throttling may reduce detection likelihood by maintaining system responsiveness during encryption. Geofencing limits its impact to targeted regions, avoiding certain countries. The broad sector and geographic impact indicate a significant threat to organizations worldwide.

Microsoft provides detection capabilities through Microsoft Defender and detailed indicators of compromise to identify DeadLock ransomware activity. Organizations should apply these detections and follow Microsoft’s mitigation guidance as outlined in their security blog. No official patch or fix exists since this is malware rather than a software vulnerability. Defensive measures should focus on detection, incident response, and recovery planning. The decentralized nature of the ransomware’s infrastructure means disruption efforts may be less effective, so comprehensive defense-in-depth and rapid response are critical.