Microsoft Threat Intelligence analyzed DeadLock, an emerging ransomware operation that relies on a Rust-based encryptor and decentralized operational infrastructure. The malware uses smart contracts hosted on the Polygon blockchain to retrieve proxy addresses and leak site data, alongside the Session messaging network for victim communications.
Victims and distribution
First observed in July 2025, DeadLock employs double extortion by encrypting victim networks while threatening to publish stolen records. Microsoft reported that as of July 2026, the operators had published details from more than 80 compromised organizations on their leak site, with over half located in Europe. Affected entities span information technology, mining, transportation, manufacturing, hospitality, and consumer goods across North America, South America, Europe, Asia, and Africa.
Multiple threat groups deploy the ransomware in campaigns. Microsoft observed DeadLock being delivered by affiliates associated with the Lynx and INC ransomware ecosystems.
Execution and evasion
DeadLock begins by decrypting an embedded configuration using XOR decoding with an 8-byte key. The malware checks default system and user interface language IDs, terminating and self-deleting immediately if it detects languages tied to Commonwealth of Independent States members or select Middle Eastern countries. If invoked without elevated administrative privileges or specific target command-line paths, the malware creates a randomly named batch file to trigger Windows User Account Control prompts, retrying up to 10 times.
When running with elevated access, the encryptor enables administrative tokens including SeDebugPrivilege and SeBackupPrivilege to access restricted files. DeadLock silently empties system recycle bins, registers a custom icon for files with the .dlock extension, and terminates security, backup, and Active Directory services. To eliminate forensic traces, the malware clears event log channels directly via Windows APIs, modifies registry keys to disable future channel recording, and enumerates custom channels using wevtapi.dll.
Throttling and encryption
DeadLock incorporates a resource-aware throttling system to maintain system responsiveness during operation. Dedicated monitoring threads poll memory and CPU utilization before dispatching each file. If system memory usage exceeds 29 percent or CPU load exceeds 70 percent, the malware pauses dispatching new files until resource usage drops back below those thresholds.
The encryption pipeline combines Curve25519 elliptic-curve cryptography with the XChaCha20 stream cipher, using NaCl crypto_box constructions to wrap per-file symmetric keys. DeadLock applies a tiered policy based on file size, encrypting smaller files completely while applying intermittent encryption in 512-byte blocks for files larger than 50 megabytes.
Decentralized recovery
Instead of relying on central web domains that law enforcement could seize, DeadLock drops an interactive HTML page that acts as a single-page recovery application. The web app sends read-only calls to public Polygon blockchain RPC endpoints to retrieve proxy server addresses and paginated leak blog posts from smart contracts.
Victim messaging is routed through the decentralized Session messaging network using onion routing. The HTML recovery chat generates the victim's Session identity deterministically from the sign-in credentials they enter on the page. Because no registration takes place on a central server, Microsoft noted that losing these credentials leaves the chat identity permanently unrecoverable.
