Microsoft Threat Intelligence presented a technical analysis of the DeadLock ransomware, a financially motivated operation that combines encrypting victims’ environments with threats to publish stolen data, while using a decentralized architecture to support negotiation, communication, and leak publication. Microsoft believes this design may increase the resilience of parts of the operational infrastructure against disruption attempts because the ransomware does not depend entirely on a single traditional domain or server.
DeadLock first appeared in July 2025, and Microsoft observed its use by multiple groups, including an entity associated with the Lynx and INC ransomware ecosystems. By July 2026, the operators had published more than 80 compromised organizations on the data-leak site known as the DeadLock blog, and more than half of the disclosed victims were in Europe. The operation was observed affecting organizations in the information technology, mining, transportation, logistics, manufacturing, hospitality, consumer goods, and other sectors across Europe, Asia, North America, South America, and Africa.
Attack Preparation and Security Control Disruption
The encryptor decrypts embedded settings using XOR and an 8-byte key, then checks the system’s default and user-interface languages. If either matches the exclusion list, the ransomware deletes itself and exits without encrypting anything. This behavior indicates the use of language- or country-based geofencing to avoid environments associated with the former Soviet Union and the Commonwealth of Independent States, as well as certain Middle Eastern countries.
Execution behavior changes according to command-line parameters and privilege levels. When a specific directory path is provided, the ransomware skips the setup steps and proceeds directly to encrypting accessible files. When run without parameters and without elevated privileges, it attempts to create a randomly named .cmd file and execute it using ShellExecuteW and RunAs to display a User Account Control prompt, retrying up to 10 times if the user rejects the request. According to the sample’s dynamic analysis, restarting with elevated privileges did not succeed, meaning that some setup stages may require the sample to be run from a context that already has the necessary privileges.
After obtaining administrator privileges, DeadLock enables privileges such as SeDebugPrivilege, SeRestorePrivilege, SeBackupPrivilege, SeTakeOwnershipPrivilege, SeAuditPrivilege, and SeSecurityPrivilege. It also empties the Recycle Bin on all drives and stops processes and services that could hinder encryption or assist recovery, including Windows Defender, backup services, and Volume Shadow Copy, as well as certain Hyper-V and Active Directory services, along with security, cloud backup, and remote-access tools.
The ransomware attempts to erase evidence of the compromise by clearing event-log channels, disabling future event logging, and restricting access permissions to them. This includes standard channels and channels custom-created for other applications, using both traditional and modern APIs and registry modifications.
Encryption Balancing Speed and System Responsiveness
DeadLock uses a mechanism to limit resource consumption during encryption. It monitors memory and CPU idle percentage before sending each new file to the encryption threads; dispatching pauses temporarily if memory usage exceeds 29% or CPU load exceeds 70%, then resumes when usage decreases. This mechanism does not interrupt files whose encryption has already started, but reduces concurrency and helps keep the system responsive, potentially reducing the likelihood of attracting the user’s attention through system freezing or unusually high resource consumption.
The ransomware creates threads for processing directories at a rate equal to twice the number of processor cores, and renames files by adding an identifier and the .dlock extension. Its cryptographic design combines Curve25519 and XChaCha20: it generates a different key and nonce for each file, then uses Curve25519 key exchange to wrap the symmetric encryption key. According to Microsoft, the cryptographic design offers no practical way to decrypt the files without the attacker’s private key.
DeadLock also applies an encryption policy based on file size. Large files may be partially encrypted using 512-byte blocks distributed across intervals, making the file unusable while reducing the time required for the operation. After encryption, the ransomware adds a structured trailer containing the data required for decryption, the temporary public key, a random file identifier, and indicators specifying the encryption method used.
Decentralized Recovery Architecture
The ransomware drops text ransom notes in encrypted directories, along with HTML files at drive roots and in Desktop folders. The RECOVERY_CHAT.<UID>.html file functions as a self-contained application that includes end-to-end encrypted chat, a data-leak blog, and a file browser without relying on a traditional backend server.
DeadLock stores configuration data and the leak-blog content in smart contracts on the Polygon blockchain. The application retrieves the relay-server address through read requests to public RPC endpoints, switching among six endpoints to provide a degree of continuity. The operator can modify the relay-server address through the smart contract without changing the infrastructure visible to the victim or registering a new domain.
Communication with victims takes place through the decentralized Session network, which uses onion-like routing and storage based on groups of nodes. The victim’s Session identity is deterministically derived from the login data; therefore, the same data produces the same key pair, and no account creation is required. However, forgetting the login data makes the identity unrecoverable, according to what the chat interface displays.
The recovery page also supports viewing leaked files hosted through Wasabi. The application includes an AWS S3-compatible browser that parses credentials from the URL, creates requests signed with AWS4-HMAC-SHA256, and generates presigned download links.
Resilience Limitations and Defensive Recommendations
This architecture does not make the operation completely independent of traditional infrastructure. Access to the chat depends on the relay server, and the page requires at least one public RPC endpoint, while leaked images and files can be removed from CDN or Wasabi services. Nevertheless, the operators rely less on a single messaging server or domain, complicating some blocking and takedown efforts.
Microsoft recommends enabling cloud-delivered protection in Microsoft Defender Antivirus or an equivalent solution, running EDR in block mode, enabling tamper protection, and configuring automated investigation and remediation. It also recommends enabling Automatic Attack Disruption in Microsoft Defender XDR, applying Controlled Folder Access, and using attack surface reduction rules, including blocking executable files that do not meet prevalence, age, or trusted-list criteria, and blocking process creation originating from PSExec and WMI commands while considering the compatibility impact on some servers.
Microsoft Defender Antivirus identifies the threat components under the name Ransom:Win32/Deadlock.*, while alerts such as ransomware behavior detection, deletion of backups, or changing the desktop wallpaper may indicate activity associated with the operation, with Microsoft warning that some of these alerts may be caused by other threats. The Microsoft post also includes indicators of compromise, Defender detections, and mitigation guidance, making it a practical reference for defense teams reviewing their environments’ ability to withstand DeadLock or similar ransomware operations.