DeadLock ransomware: Breaking down a Rust-based encryptor with decentralized recovery infrastructure
In this article Pre-encryption Encryption Post-encryption Defending against DeadLock ransomware Indicators of compromise Microsoft Threat Intelligence tracks DeadLock ransomware as an emerging financially motivated operation distinguished by its use of decentralized infrastructure to support victim communications and data leak operations. Its recovery ecosystem combines the Session messaging network with blockchain-backed services that store and deliver resources used throughout the extortion process. This architecture likely increases the resilience of portions of its communication, leak-hosting, and negotiation infrastructure, allowing DeadLock operators to recover from some disruption efforts while maintaining continuity for victims. Microsoft has observed DeadLock ransomware being deployed by multiple groups including an affiliate of the Lynx and INC ransomware ecosystems. First observed in July 2025, DeadLock operators employ double extortion tactics, encrypting victim environments while threatening to publicly release exfiltrated data. As of July 2026, the operators have published more than 80 compromised organizations on their data leak site, called the DeadLock blog, with more than half of the claimed victims in Europe. Microsoft identified DeadLock ransomware impacting organizations across information technology (IT), mining, transportation and logistics, manufacturing, hospitality, consumer goods, and other sectors in Europe, Asia, North America, South America, and Africa. The DeadLock encryptor includes a resource-aware throttling mechanism designed to maintain system responsiveness during encryption. In addition to its encryption capabilities, the ransomware also appears to implement language or country-based geofencing designed to avoid running in environments associated with former Soviet and Commonwealth of Independent States (CIS)-linked countries as well as select Middle Eastern countries, a pattern commonly observed among ransomware operators believed to operate from those regions. Together, these capabilities demonstrate how DeadLock combines established ransomware tradecraft with decentralized infrastructure designed to improve operational resilience. In this blog, we present a technical analysis of the DeadLock ransomware encryptor, covering its execution flow, defense evasion techniques, encryption design, and post-encryption behaviors, including a decentralized recovery chat system. We also provide indicators of compromise (IOCs), Microsoft Defender detections, and mitigation guidance to help organizations defend against this threat and similar ransomware activity. Pre-encryption Configuration parsing Before performing any malicious activity, the DeadLock encryptor decrypts an embedded configuration blob using XOR decoding with an 8-byte key. Below are the malware’s configuration fields and their values. Field Value Victim UID Malware public key 03bf50bbf97c4e951e66ff12b689a37a3ce675b4921e254eae76da77573843e4a9 Encryption rule 1000,05052429880,025124288000,010524288000,F991114288000 Language exclude list Geofencing language IDs (see Language geofencing ) Process stop list Processes to terminate (see Process and service termination ) Service stop list Services to stop and delete (see Process and service termination ) File exclude list Extensions and file names to avoid encrypting (see Directory traversal ) Directory exclude list Pre-traversal filter with directories to avoid encrypting (see Directory traversal ) Sub-path Exclude List Sub-paths to avoid encrypting during traversal (see Directory traversal ) Text ransom note Full text ransom note content (see Ransom notes deployment ) HTML recovery chat Full HTML/JS interactive chat page (see Recovery chat: Technical architecture ) Language geofencing As an early exit check, the malware queries the system’s default and user interface (UI) languages. If either language matches the exclude list in the configuration, the malware self-deletes immediately withou…
AI Analysis
Technical Summary
DeadLock ransomware is an emerging financially motivated threat tracked by Microsoft Threat Intelligence since July 2025. It is distinguished by its use of decentralized infrastructure combining the Session messaging network and blockchain-backed services to support victim communications, data leak hosting, and extortion processes, enhancing resilience against disruption. The ransomware is written in Rust and features resource-aware throttling to reduce system impact during encryption. It implements geofencing based on system language settings to avoid execution in environments linked to former Soviet, CIS, and select Middle Eastern countries. DeadLock operators employ double extortion by encrypting victim environments and threatening data leaks, with over 80 organizations publicly listed as victims by mid-2026. The malware terminates specific processes and services, excludes certain files and directories from encryption, and delivers ransom notes and an interactive recovery chat page. Multiple ransomware groups, including affiliates of Lynx and INC ecosystems, have deployed DeadLock. Microsoft provides comprehensive technical details, detection capabilities, and mitigation recommendations in their security blog.
Potential Impact
DeadLock ransomware encrypts victim data, disrupting business operations, and uses double extortion by threatening to publicly release stolen data, increasing pressure on victims to pay ransom. Its decentralized infrastructure improves the attackers' ability to maintain communication and data leak operations despite disruption attempts, potentially prolonging the attack lifecycle. The ransomware's resource-aware throttling may reduce detection likelihood by maintaining system responsiveness during encryption. Geofencing limits its impact to targeted regions, avoiding certain countries. The broad sector and geographic impact indicate a significant threat to organizations worldwide.
Mitigation Recommendations
Microsoft provides detection capabilities through Microsoft Defender and detailed indicators of compromise to identify DeadLock ransomware activity. Organizations should apply these detections and follow Microsoft’s mitigation guidance as outlined in their security blog. No official patch or fix exists since this is malware rather than a software vulnerability. Defensive measures should focus on detection, incident response, and recovery planning. The decentralized nature of the ransomware’s infrastructure means disruption efforts may be less effective, so comprehensive defense-in-depth and rapid response are critical.
Indicators of Compromise
- url: http://1rpc.io/matic
- domain: deadlock.liveblog365.com
- domain: polygon.meowrpc.com
- hash: a1fdf65020ce4a0f0940c793c6425baf8a0b994ec48b9baaf72788661a9d29f4
- domain: deadblogdbdu5wprek7wa2o4ce7rnt6u6ntqeud3hzjjcveosgpsqqqd.onion
- domain: deadlockblog.medianewsonline.com
- domain: deadlockblog.great-site.net
- domain: dlock.liveblog365.com
DeadLock ransomware: Breaking down a Rust-based encryptor with decentralized recovery infrastructure
Description
In this article Pre-encryption Encryption Post-encryption Defending against DeadLock ransomware Indicators of compromise Microsoft Threat Intelligence tracks DeadLock ransomware as an emerging financially motivated operation distinguished by its use of decentralized infrastructure to support victim communications and data leak operations. Its recovery ecosystem combines the Session messaging network with blockchain-backed services that store and deliver resources used throughout the extortion process. This architecture likely increases the resilience of portions of its communication, leak-hosting, and negotiation infrastructure, allowing DeadLock operators to recover from some disruption efforts while maintaining continuity for victims. Microsoft has observed DeadLock ransomware being deployed by multiple groups including an affiliate of the Lynx and INC ransomware ecosystems. First observed in July 2025, DeadLock operators employ double extortion tactics, encrypting victim environments while threatening to publicly release exfiltrated data. As of July 2026, the operators have published more than 80 compromised organizations on their data leak site, called the DeadLock blog, with more than half of the claimed victims in Europe. Microsoft identified DeadLock ransomware impacting organizations across information technology (IT), mining, transportation and logistics, manufacturing, hospitality, consumer goods, and other sectors in Europe, Asia, North America, South America, and Africa. The DeadLock encryptor includes a resource-aware throttling mechanism designed to maintain system responsiveness during encryption. In addition to its encryption capabilities, the ransomware also appears to implement language or country-based geofencing designed to avoid running in environments associated with former Soviet and Commonwealth of Independent States (CIS)-linked countries as well as select Middle Eastern countries, a pattern commonly observed among ransomware operators believed to operate from those regions. Together, these capabilities demonstrate how DeadLock combines established ransomware tradecraft with decentralized infrastructure designed to improve operational resilience. In this blog, we present a technical analysis of the DeadLock ransomware encryptor, covering its execution flow, defense evasion techniques, encryption design, and post-encryption behaviors, including a decentralized recovery chat system. We also provide indicators of compromise (IOCs), Microsoft Defender detections, and mitigation guidance to help organizations defend against this threat and similar ransomware activity. Pre-encryption Configuration parsing Before performing any malicious activity, the DeadLock encryptor decrypts an embedded configuration blob using XOR decoding with an 8-byte key. Below are the malware’s configuration fields and their values. Field Value Victim UID Malware public key 03bf50bbf97c4e951e66ff12b689a37a3ce675b4921e254eae76da77573843e4a9 Encryption rule 1000,05052429880,025124288000,010524288000,F991114288000 Language exclude list Geofencing language IDs (see Language geofencing ) Process stop list Processes to terminate (see Process and service termination ) Service stop list Services to stop and delete (see Process and service termination ) File exclude list Extensions and file names to avoid encrypting (see Directory traversal ) Directory exclude list Pre-traversal filter with directories to avoid encrypting (see Directory traversal ) Sub-path Exclude List Sub-paths to avoid encrypting during traversal (see Directory traversal ) Text ransom note Full text ransom note content (see Ransom notes deployment ) HTML recovery chat Full HTML/JS interactive chat page (see Recovery chat: Technical architecture ) Language geofencing As an early exit check, the malware queries the system’s default and user interface (UI) languages. If either language matches the exclude list in the configuration, the malware self-deletes immediately withou…
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
DeadLock ransomware is an emerging financially motivated threat tracked by Microsoft Threat Intelligence since July 2025. It is distinguished by its use of decentralized infrastructure combining the Session messaging network and blockchain-backed services to support victim communications, data leak hosting, and extortion processes, enhancing resilience against disruption. The ransomware is written in Rust and features resource-aware throttling to reduce system impact during encryption. It implements geofencing based on system language settings to avoid execution in environments linked to former Soviet, CIS, and select Middle Eastern countries. DeadLock operators employ double extortion by encrypting victim environments and threatening data leaks, with over 80 organizations publicly listed as victims by mid-2026. The malware terminates specific processes and services, excludes certain files and directories from encryption, and delivers ransom notes and an interactive recovery chat page. Multiple ransomware groups, including affiliates of Lynx and INC ecosystems, have deployed DeadLock. Microsoft provides comprehensive technical details, detection capabilities, and mitigation recommendations in their security blog.
Potential Impact
DeadLock ransomware encrypts victim data, disrupting business operations, and uses double extortion by threatening to publicly release stolen data, increasing pressure on victims to pay ransom. Its decentralized infrastructure improves the attackers' ability to maintain communication and data leak operations despite disruption attempts, potentially prolonging the attack lifecycle. The ransomware's resource-aware throttling may reduce detection likelihood by maintaining system responsiveness during encryption. Geofencing limits its impact to targeted regions, avoiding certain countries. The broad sector and geographic impact indicate a significant threat to organizations worldwide.
Defensive Guidance
Microsoft provides detection capabilities through Microsoft Defender and detailed indicators of compromise to identify DeadLock ransomware activity. Organizations should apply these detections and follow Microsoft’s mitigation guidance as outlined in their security blog. No official patch or fix exists since this is malware rather than a software vulnerability. Defensive measures should focus on detection, incident response, and recovery planning. The decentralized nature of the ransomware’s infrastructure means disruption efforts may be less effective, so comprehensive defense-in-depth and rapid response are critical.
Technical Details
- Classification
- {"confidence":0.71,"severitySource":"heuristic","classifier":"rss-v2"}
- Article Source
- {"url":"https://www.microsoft.com/en-us/security/blog/2026/08/10/deadlock-ransomware-breaking-down-a-rust-based-encryptor-with-decentralized-recovery-infrastructure/","fetched":true,"fetchedAt":"2026-08-10T21:23:12.357Z","wordCount":5546}
Indicators of Compromise
Url
| Value | Description | Copy |
|---|---|---|
urlhttp://1rpc.io/matic | — |
Domain
| Value | Description | Copy |
|---|---|---|
domaindeadlock.liveblog365.com | — | |
domainpolygon.meowrpc.com | — | |
domaindeadblogdbdu5wprek7wa2o4ce7rnt6u6ntqeud3hzjjcveosgpsqqqd.onion | — | |
domaindeadlockblog.medianewsonline.com | — | |
domaindeadlockblog.great-site.net | — | |
domaindlock.liveblog365.com | — |
Hash
| Value | Description | Copy |
|---|---|---|
hasha1fdf65020ce4a0f0940c793c6425baf8a0b994ec48b9baaf72788661a9d29f4 | — |
Threat ID: 6a7a4144bf8831d53990704d
Added to database: 08/10/2026, 21:23:16 UTC
Last enriched: 08/10/2026, 21:23:35 UTC
Last updated: 09/23/2026, 04:17:48 UTC
Views: 174
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.