DeadLock ransomware marks a significant shift in how cybercriminals design their operations. Between July 2025 and July 2026, this Rust-based encryptor compromised over 80 organizations across six continents. The focus here isn't the incident itself, but how its operators built resilience into their infrastructure, and what this means for your incident response and business continuity plans.
How DeadLock Operates
DeadLock operators use traditional double extortion tactics combined with a decentralized recovery ecosystem. Instead of relying on centralized servers for victim communications and data leaks, they use the Session messaging network and blockchain-backed services. This setup allows them to recover from takedown attempts while maintaining continuity for victims trying to negotiate or access recovery instructions.
Microsoft Threat Intelligence identified DeadLock affecting sectors like IT, mining, transportation, manufacturing, hospitality, and consumer goods. Over half of the victims were in Europe, with others in Asia, North America, South America, and Africa.
Timeline of Events
July 2025: First DeadLock samples detected.
July 2025 - July 2026: Operators list over 80 compromised organizations on their data leak site.
Throughout the campaign: Multiple groups, including affiliates of the Lynx and INC ransomware ecosystems, deploy DeadLock.
The encryptor uses geofencing to avoid execution in former Soviet and Commonwealth of Independent States countries, plus some Middle Eastern countries. This suggests operators from those regions, following established ransomware tactics.
Identifying Control Failures
DeadLock incidents reveal gaps in how organizations prepare for ransomware that can't be disrupted through traditional infrastructure takedowns:
Detection controls: The encryptor uses resource-aware throttling, polling CPU and memory utilization before encrypting files. This keeps systems responsive, making detection harder. Your endpoint detection tools must identify encryption activity even when it's paced to avoid performance anomalies.
Privilege management: DeadLock tries to elevate privileges up to 10 times if initially denied. Once elevated, it enables several high-level privileges, allowing it to interact with system processes and files that should be restricted.
Service availability: The malware disables services that could interfere with encryption or enable recovery, including Windows Defender, Volume Shadow Copy, and Active Directory services. It also targets backup applications and remote access software.
Forensic capability: DeadLock clears event logs using API calls, registry manipulation, and enumeration of custom channels. This erases forensic evidence, hindering your incident response team's ability to reconstruct the attack timeline.
Communication resilience: Your incident response plan might assume you can disrupt attacker infrastructure with law enforcement. Decentralized systems make this assumption obsolete. The Session network and blockchain services lack a central point of failure to target.
Meeting Standard Requirements
NIST CSF Core Functions provide a framework to address these gaps:
Identify (ID.AM-2, ID.AM-3): Maintain an accurate inventory of software and data flows. DeadLock targets specific services. Without knowing what's running, you can't protect or detect disruptions.
Protect (PR.AC-4, PR.AC-6): Enforce least privilege principles. The malware's ability to enable multiple high-privilege tokens suggests excessive permissions. Manage identities and credentials according to policy, not just UAC prompts.
Detect (DE.AE-2, DE.AE-3): Analyze detected events to understand attack methods. Resource-aware throttling complicates this, but your detection logic must account for paced attacks.
Respond (RS.AN-1, RS.AN-3): Investigate detection notifications and perform forensic analysis. DeadLock's log clearing undermines this. Forward logs to external collectors in real time.
Recover (RC.RP-1): Execute your recovery plan during or after an incident. When malware disables backup services, your plan fails unless you've built recovery capabilities the ransomware can't reach.
Action Items for Your Team
1. Build untouchable recovery infrastructure
DeadLock disables local backups and cloud syncs. Your recovery must reside outside the encrypted environment. Use immutable backups with network segmentation to protect backup infrastructure. Test restoration quarterly.
2. Forward logs to external collectors
Local log clearing doesn't affect external channels. Configure endpoints to forward logs to a SIEM or log management platform in real time. This preserves evidence for forensic analysis and insurance claims.
3. Enforce application control policies
DeadLock's UAC elevation succeeds when users approve prompts. Application control policies can block unauthorized executables, even if users approve elevation. This is effective against ransomware using social engineering.
4. Monitor service state changes
The malware disables critical services. Your monitoring should alert when services like Windows Defender or Volume Shadow Copy change state. This provides detection even if ransomware evades endpoint protection.
5. Separate negotiation planning from infrastructure assumptions
Your incident response plan may include law enforcement coordination. These steps matter, but won't stop decentralized ransomware from maintaining communications. Develop a separate decision tree for scenarios where takedowns don't work.
6. Test privilege escalation defenses
Conduct tests to enable high-value tokens from standard user contexts. If your monitoring doesn't alert, there's a gap. These escalations are precursors to ransomware encryption and data exfiltration.
The shift to decentralized infrastructure isn't just about one ransomware family. It's about threat actors learning from past takedowns and building systems that survive disruption. Your business continuity and incident response plans must account for attackers who've solved the resilience problem you're still addressing.
