Loading story…
Biopharmaceutical company Diater has been listed on the dark-web leak site of the DeadLock ransomware group, in an incident that could expose highly sensitive information tied to patients and healthcare professionals. Reporting indicates the attackers are using a double-extortion model, combining data theft with encryption, and that records retained by Diater for up to 10 years may be at risk of public release.
The attackers reportedly claim to have stolen directories containing user folders, documents, QM files, and material linked to EDICOM, although the ransom demand, intrusion date, and full scope of exfiltration have not been disclosed. DeadLock, a ransomware operation first observed in mid-2025 and associated with Russian-origin actors, is known for appending the .dlock extension to encrypted files, adding to concerns that the Diater incident could affect both operational systems and long-term medical data confidentiality.
TTPs, infrastructure, and targeting history in one profile.
2 events from the most recent confirmed update back to the earliest known activity.
The DeadLock ransomware group was first detected in mid-2025. Reporting describes it as a Russian-linked operation that uses double extortion tactics.
Biopharmaceutical company Diater appeared on the DeadLock ransomware group's dark web victim list. The group claimed to have stolen directories containing user folders, documents, QM files, and EDICOM-related material, raising concerns about exposure of sensitive patient and healthcare professional data.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcedatabreaches.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft reported that the **DeadLock** ransomware operation has emerged as a financially motivated threat using **double extortion** and a decentralized recovery ecosystem designed to resist disruption. First observed in July 2025, DeadLock had listed **more than 80 claimed victims** by July 2026, with over half in Europe, and has affected organizations across multiple sectors and regions. Microsoft said the malware has been deployed by multiple groups, including an affiliate tied to the **Lynx** and **INC** ransomware ecosystems. The Rust-based encryptor combines common ransomware tradecraft with an unusual communications and leak infrastructure. Microsoft said DeadLock attempts privilege escalation, terminates services and processes, clears event logs, selectively encrypts files, drops ransom notes, and self-deletes, while its recovery workflow relies on a local HTML chat app, the **Session** messaging network, **Polygon** smart contracts for configuration and blog data, and **Wasabi**-hosted stolen files exposed through an S3-compatible browser. The company also described DeadLock's hybrid cryptography using `Curve25519` and `XChaCha20` with per-file ephemeral keys, assessing the scheme as cryptographically sound and leaving no practical decryption path without the attackers' private key.
Aug 18, 2026
**DoppelPaymer** ransomware operators used phishing emails, malicious attachments, and links to gain initial access, often chaining infections through **Emotet** and **Dridex** before deploying the final payload. After compromise, the attackers used tools including **PowerShell Empire**, **Cobalt Strike**, **PsExec**, and **Mimikatz** to steal credentials, move laterally, disable security controls, and prepare systems for encryption. The malware encrypted files on network, fixed, and removable drives, changed user passwords, rebooted systems into safe mode, and displayed a ransom note warning that stolen sensitive data could be leaked publicly. The campaign disproportionately affected **healthcare, emergency services, and education** organizations, with reported incidents including a German hospital, a county **E911** center, community colleges, and police and emergency services in a U.S. city. The activity highlighted a double-extortion model in which operational disruption was paired with data-theft pressure, while defenders were urged to harden email security, maintain offline backups, patch exposed systems, audit privileged accounts, monitor network traffic, enable **2FA**, and enforce least-privilege access.
Aug 14, 2026
**MedusaLocker** has continued to evolve from its 2019 origins into a mature ransomware operation that targets enterprise networks through exposed or weakly secured **RDP**, stolen or brute-forced credentials, phishing, spam, and vulnerable VPN or edge devices. U.S. government reporting has described the threat as a **ransomware-as-a-service** model in which affiliates conduct intrusions and share proceeds with developers, while multiple technical profiles show the malware encrypting local disks, mapped drives, accessible **SMB** shares, and broader network resources after gaining a foothold. Later variants, including **MedusaLocker v3** or **BabyLockerKZ**, also steal data to support **double extortion** and focus on maximizing damage inside victim environments rather than relying on external command-and-control traffic. Across variants, MedusaLocker uses **AES-256** encryption with **RSA-2048** key protection, deletes shadow copies and backups to hinder recovery, and establishes persistence through scheduled tasks, roaming-profile executables, and registry-based mechanisms such as `HKCU\SOFTWARE\PAIDMEMES` or `HKEY_CURRENT_USER\SOFTWARE\MDSLK\Self`. Researchers and government agencies report additional behaviors including PowerShell execution, safe-mode reboots to impair defenses, UAC bypass, process termination to unlock files, ICMP network sweeping, CIDR-aware share discovery, hidden-volume mounting, and self-relaunch with a `-network` argument to widen encryption. The malware has used changing file extensions such as `.meduza216` and varying ransom note names including **How_to_back_files.html**, **HOW_TO_RECOVER_DATA**, and related templates, with victims reported across healthcare, finance, government, and manufacturing.
Aug 15, 2026