DeadLock Ransomware Decryption & Data Recovery

DeadLock was first publicly documented in July 2025, earliest sample late June 2025. No public research ties it to a rebrand, so treat it as a genuinely new crew. It ran quietly for almost a year: the leak site appeared only in June 2026, already carrying roughly 80 organisations when ZeroFox observed it on 16 June.

Microsoft and Group-IB published detailed analyses in August 2026. What draws attention is not the cipher suite but the decentralised extortion infrastructure: command-and-control proxy addresses live in a Polygon smart contract and rotate at will, leak-site posts come from a second contract, negotiation runs over Session, and stolen files sit on Wasabi storage. Domain blocking and server seizures cannot cleanly break this stack.

Victim counts: third-party ransomware trackers put the cumulative leak-site total at roughly 101 organisations by early September 2026, more than half of them European, with manufacturing the most heavily represented sector alongside IT, mining and transportation. Note that no new leak-site posts have appeared since late August 2026 and the clearnet domain has at times failed to resolve, but no seizure or shutdown has been announced, so the operation should still be treated as live.

Microsoft's analysis notes DeadLock is not an openly recruiting RaaS, yet several actors have deployed it, including one operating within the Lynx and INC ecosystems. No public report confirms a targeted campaign against mainland China organisations, and no Chinese-language vendor analysis has been published.

Extension. Encrypted files gain the victim ID plus .dlock appended to the original name - a short hex ID identical across the environment, so report.xlsx becomes report.xlsx.F8C6A8.dlock. Published samples show six characters, but Microsoft redacted that field, so whether the length is constant across builds is unsettled; identify on the structure "original name + hex string + .dlock".

Ransom notes. Early samples dropped READ ME.[ID].txt; current builds drop HOW_RECOVER.[ID].txt and RECOVERY_CHAT.[ID].html. The HTML file is a self-contained negotiation client with a "Blog" tab read straight from the Polygon contract, walking the victim through installing Session to make contact. No email address appears in the disclosed samples.

Icons and desktop. The encryptor writes an embedded icon to C:\ProgramData[ID].ico and registers it in the registry as the default icon for the .dlock extension, so every encrypted file shows the same attacker-supplied icon - a strong visual tell. The wallpaper is also replaced with a notice that files are encrypted and stolen and that the operators must be contacted; published reports do not agree on exact wallpaper wording, so do not match on the string.

Other indicators. A silent AnyDesk install with RDP and RemoteRegistry enabled; event log channels cleared one by one and then disabled in the registry; after encryption the binary writes a batch file to delete itself, so the encryptor is often absent from the scene.

State this up front: DeadLock's initial access vector is still publicly undetermined. Group-IB says plainly that it remains unknown and Microsoft's analysis does not disclose it; incident responders have only observed the actors using valid remote access accounts, with no published report confirming how those credentials were obtained - phishing, brute force, infostealer logs or an access broker. Do not scope an investigation around one assumed entry point; audit the whole remote access surface.

The post-compromise behaviour that is documented looks like this - hands-on-keyboard and unhurried; in the best-documented intrusion, about five days passed between compromise and encryption:

• Valid account login. Entry with compromised remote desktop and domain accounts, reading much like ordinary administrator activity in logs.
• Persistence. Remote Desktop enabled by setting fDenyTSConnections to 0 with an inbound rule for TCP 3389, the RemoteRegistry service started, and AnyDesk installed silently with automatic startup, updates disabled and an unattended access password as a second channel.
• Discovery. Built-in commands only - nltest for domain controllers, net localgroup /domain for privileged groups, quser for active sessions, ping to map reachable hosts.
• Endpoint protection defeat. One vendor incident analysis records a BYOVD step - loading a legitimately signed but vulnerable driver to terminate endpoint protection from kernel mode. That detail appears in a single source and is corroborated by neither Microsoft nor Group-IB, so the specific driver and CVE are not cited here.
• Exfiltration. The actors claim theft before encryption and extort with leak-site publication, but no published report confirms the exfiltration tooling or staging destination; whether data actually left has to be proven from your own network and log evidence.

Samples carry a language and locale switch: on detecting Russian, Ukrainian, Belarusian, Kazakh, Uzbek and other CIS or post-Soviet languages, plus Persian and Syriac among others, and covering Oman and Yemen, the malware deletes itself immediately and does not encrypt. Such switches usually indicate where the operators are based.

Algorithms. The current build is Rust. File contents use XChaCha20 with a fresh one-time key per file; that key is protected by an ephemeral Curve25519 keypair doing ECDH against the operator public key, wrapped under the derived key and stored in the file alongside its metadata. No exploitable flaw has been published.

Tiered intermittent encryption. Files are handled by size tier. Small files are encrypted in full; from roughly 50 MB the encryptor overwrites 512-byte blocks at fixed intervals, and the encrypted share steps down as files grow - about 50% from ~50 MB, 25% from ~118 MB, 10% from ~500 MB, with a separate chunked mode above ~1 GB. Microsoft describes this explicitly as an optimisation for large files such as databases, virtual machine images and backups. The consequence: services die immediately, yet large untouched regions survive inside those same files, leaving room for structural repair.

Recovery inhibition. A set of services that would block file access is stopped and disabled - windefend, the shadow copy and backup services vss / swprv / wbengine, the Hyper-V services vmcompute / vmms, and the Active Directory services adws / ntds / kdc. Processes including msmpeng, onedrive, dropbox, anydesk, explorer and powershell are terminated. Every registered event log channel is enumerated through the Event Log API, cleared, and then disabled in the registry. Earlier builds additionally targeted the services of several mainstream commercial backup products.

An important clarification on shadow copies. What published analysis records is that the shadow copy service is stopped and disabled - not that existing shadow copies are deleted with vssadmin, wmic or similar. That differs from most families and means surviving shadow copies are genuinely possible on site. Check every host rather than assuming they are gone.

Self-deletion. After encryption the binary writes a batch file to delete itself, so the encryptor sample is frequently unavailable for forensics.

Double extortion. The actors claim data is stolen before encryption; non-payment brings staged publication on the clearnet site and its Tor mirror.