Loading story…
Microsoft reported that the DeadLock ransomware operation has emerged as a financially motivated threat using double extortion and a decentralized recovery ecosystem designed to resist disruption. First observed in July 2025, DeadLock had listed more than 80 claimed victims by July 2026, with over half in Europe, and has affected organizations across multiple sectors and regions. Microsoft said the malware has been deployed by multiple groups, including an affiliate tied to the Lynx and INC ransomware ecosystems.
The Rust-based encryptor combines common ransomware tradecraft with an unusual communications and leak infrastructure. Microsoft said DeadLock attempts privilege escalation, terminates services and processes, clears event logs, selectively encrypts files, drops ransom notes, and self-deletes, while its recovery workflow relies on a local HTML chat app, the Session messaging network, Polygon smart contracts for configuration and blog data, and Wasabi-hosted stolen files exposed through an S3-compatible browser. The company also described DeadLock's hybrid cryptography using Curve25519 and XChaCha20 with per-file ephemeral keys, assessing the scheme as cryptographically sound and leaving no practical decryption path without the attackers' private key.
TTPs, infrastructure, and targeting history in one profile.
4 events from the most recent confirmed update back to the earliest known activity.
Microsoft released a detailed analysis of DeadLock ransomware, describing its Rust-based encryptor, decentralized recovery infrastructure, affiliate use across the Lynx and INC ecosystems, and cryptographic design. The report also provided indicators of compromise, detections, and mitigation guidance.
Microsoft reported that DeadLock had claimed 96 victims as of the reporting month, with most located in Italy, Spain, Poland, Türkiye, and the United States. This represents an increase from the more than 80 victims previously noted in July 2026.
As of July 2026, DeadLock operators had published more than 80 compromised organizations on the DeadLock blog. More than half of the claimed victims were in Europe, with victims spanning multiple sectors and regions.
Microsoft said it first observed the DeadLock ransomware operation in July 2025. The operation was tracked as an emerging financially motivated ransomware threat using double extortion.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
9 references tracked. Mallory keeps watching after this page renders.
reddit.com
Open sourcecyberveille.ch
Open sourcebleepingcomputer.com
Open sourcethehackernews.com
Open sourcecryptika.com
Open sourcecybersecuritynews.com
Open sourcemalware.news
Open sourcemicrosoft.com
Open sourcegroup-ib.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple reports highlight evolving **ransomware** tactics and growing operational scale across distinct groups. Group-IB reported that **DeadLock** is using **Polygon smart contracts** to help obscure and rapidly rotate infrastructure used to connect victims to the gang, complicating defender blocking and analysis. After encryption, DeadLock reportedly drops an HTML file that wraps the *Session* messenger workflow; the smart contract stores a proxy URL that can be frequently changed, supporting an “encryption-only” model without a traditional public data leak site. Separately, Darktrace summarized late-2025/early-2026 intelligence indicating **Medusa** (aka **Storm-1175** / **Spearwing**) has become one of the most active RaaS operations, with reporting that **500+ organizations** have been impacted and that affiliates leverage vulnerabilities for access, including Fortra *GoAnywhere MFT* `CVE-2025-10035` and multiple *SimpleHelp* issues (`CVE-2024-57726`, `CVE-2024-57727`, `CVE-2024-57728`). Trellix research (via DataBreaches/Industrial Cyber) described **CrazyHunter** as a **Prince** ransomware fork written in Go, with enhanced intrusion and evasion techniques and a focus on **Taiwan healthcare**, citing **six confirmed victims** and use of a data leak site to pressure targets.
Jun 29, 2026
Researchers reported that multiple ransomware families, including **DoNex**, **BabLock/Rorschach**, and **LockBit Black (v3)**, share substantial code and operational overlap with **LockBit**, underscoring how leaked builder code and recycled components continue to fuel new strains. SANS assessed DoNex as an unoriginal **LockBit-derived** operation closely resembling **Darkrace**, with behavior including process and service termination, network-share enumeration, event-log clearing, ransom-note deployment, and forced reboot after encryption. Trend Micro similarly found that BabLock appears heavily based on **LockBit 2.0** while incorporating features from other families, using DLL sideloading, Direct SysCalls, VMProtect, and unusual random numeric file extensions. Separate reverse engineering of LockBit v3 identified serious implementation flaws, including a **keystream reuse** bug and a design issue that could cause permanent data corruption, enabling partial decryption in some cases via an open-source decryptor. Operational reporting also showed LockBit affiliates continuing to refine delivery and post-exploitation methods. ASEC documented phishing emails posing as copyright claims that delivered LockBit through nested password-protected archives and a fake PDF executable, after which the malware deleted shadow copies, altered boot recovery settings, established persistence, and encrypted files with the `.lockbit` extension. SentinelOne described a LockBit-linked intrusion that began with **Log4Shell** exploitation against an unpatched **VMware Horizon** server and progressed to abuse of legitimate Microsoft Defender tooling for DLL sideloading of **Cobalt Strike**, alongside PowerShell execution, web-shell deployment, and other living-off-the-land techniques. Together with earlier DarkSide analysis showing similar use of **Salsa20/RSA**, service killing, shadow-copy deletion, and network-resource encryption, the reports show a ransomware ecosystem in which LockBit code, cryptography, and tradecraft are repeatedly repackaged into new campaigns and variants.
Aug 15, 2026
Reporting and research published in mid-January 2026 highlights continued **high ransomware activity** and rapid evolution in initial-access and evasion tradecraft. A Symantec/Carbon Black Threat Hunter Team study cited by *Help Net Security* reports ransomware actors claimed **4,737 attacks in 2025**, with only brief slowdowns after major disruptions; the abrupt April 2025 shutdown of **RansomHub** was followed by affiliates quickly shifting to other operations, while **LockBit** failed to recover after late-2024 law-enforcement action. The same reporting notes a broader shift toward **extortion models that don’t rely on encryption**, emphasizing data theft and coercion as groups diversify pressure tactics. Multiple technical reports describe how attackers are improving delivery and resilience. *BleepingComputer* says **Gootloader** now uses heavily malformed ZIP files—concatenating **500–1,000** ZIP archives and manipulating ZIP structures (e.g., truncated `EOCD`)—to crash or defeat common analysis tools while still extracting via Windows’ default utility, supporting its role as an initial-access vector often preceding ransomware. *The Register* reports **DeadLock** ransomware uses **Polygon smart contracts** to frequently rotate proxy infrastructure for victim communications (via an HTML wrapper pointing victims to the *Session* messenger), complicating blocking and takedown efforts; Group-IB notes DeadLock also departs from typical double-extortion by lacking a public data-leak site and instead threatening underground data sales. Separately, Microsoft-observed phishing described by *KnowBe4* shows threat actors exploiting **email routing/spoofing misconfigurations** to make phishing appear internal (often leveraging **Tycoon2FA**), while ReliaQuest’s trend report and a separate write-up on **CastleLoader** describe human-driven initial access (spearphishing/drive-by) and social-engineering lures such as **ClickFix** being used to stage loaders and follow-on payloads—underscoring that access-broker and loader ecosystems continue to feed ransomware and broader intrusion activity.
Jun 29, 2026