> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # DeadLock ransomware: Breaking down a Rust-based encryptor with decentralized recovery infrastructure - URL: https://f4n6.co.uk/security-feed/deadlock-ransomware-breaking-down-a-rust-based-encryptor-with-decentralized-recovery-infrastructure/ - Published: 2026-08-11T21:50:47.000Z - Updated: 2026-08-11T21:50:47.000Z - Author: Jeff Davies - Tags: #security-feed, DeadLock, Lynx, INC ## 1\. Executive summary Microsoft Threat Intelligence has published a detailed technical analysis of DeadLock, a Rust-based ransomware encryptor in active deployment since July 2025\. DeadLock employs double extortion and has published over 80 victim organisations on its leak site as of July 2026, with more than half of claimed victims in Europe. The operation is notable for its decentralized recovery infrastructure — using the Polygon blockchain to store proxy URLs and blog content, and the Session messaging network for victim negotiation — which significantly complicates takedown. Microsoft attributes deployment to affiliates of the Lynx and INC ransomware ecosystems; however, neither DeadLock, Lynx, nor INC has a confirmed MITRE ATT&CK profile, so this attribution must be treated as unconfirmed. EMEA financial services are exposed given the heavy European victim concentration, though no financial-services-specific targeting is described. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | --------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 18: classification of ICT-related incidents and cyber threats | DeadLock is an active ransomware threat with confirmed European victim concentration (>50% of 80+ published victims), directly relevant to threat classification and incident categorisation. | Clients should ensure DeadLock is incorporated into their ICT-related incident classification taxonomy and threat intelligence feeds as a named, active ransomware operation. | | DORA Art. 24: digital operational resilience testing — general requirements | DeadLock's defense-evasion capabilities (process/service termination of windefend, vss, backup services; event log clearing; UAC-bypass elevation) are specific TTPs that generic penetration tests may not replicate. | Clients should validate that resilience testing exercises include scenarios matching DeadLock's service-disruption and log-clearing behaviours. | No specific NIS2 or UK NIS article is directly engaged beyond general incident-management obligations that apply to any ransomware event. ## 3\. Technical analysis & attack chain **Attribution caveat:** Microsoft states DeadLock is deployed by affiliates of the Lynx and INC ransomware ecosystems. Neither Lynx, INC, nor DeadLock has a MITRE ATT&CK profile in the verified reference data; attribution is unconfirmed and single-sourced (Microsoft only). Treat with appropriate caution for enforcement decisions. ### Attack chain (confirmed from Microsoft analysis) 1. **Initial execution and configuration decryption.** The encryptor decrypts an embedded configuration blob using XOR with an 8-byte key. The configuration contains: victim UID, operator public key (`03bf50bbf97c4e951e66ff12b689a37a3ce675b4921e254eae76da77573843e4a9`), encryption rules, language exclude list, process stop list, service stop list, file/directory/sub-path exclude lists, text ransom note, and full HTML/JS recovery chat page. 2. **Geofencing exit check.** The malware queries system default and UI language. If either matches the exclude list (LANGIDs: 1049, 1058, 1059, 1064, 1065, 1067, 1068, 1079, 1087, 1088, 1090, 1114, 2072, 2092, 2115, 8193, 9217), the malware self-deletes immediately without encrypting. 3. **Privilege elevation (if not elevated, no command-line argument).** The malware generates a randomly named `.cmd` file (8 uppercase characters, e.g. `ESYEKQSY.cmd`) and executes it via `ShellExecuteW` with the `RunAs` verb, triggering UAC. Retries up to 10 times if denied. In dynamic analysis, this elevation did not succeed; full preparation requires an already-elevated context. If a target directory path is passed as a command-line argument, the malware skips all preparation and jumps directly to encryption. 4. **Privilege expansion.** When elevated, the malware enables `SeDebugPrivilege`, `SeRestorePrivilege`, `SeBackupPrivilege`, `SeTakeOwnershipPrivilege`, `SeAuditPrivilege`, and `SeSecurityPrivilege`. 5. **Recycle bin clearing.** Silently empties the recycle bin on all drives. 6. **Icon registration.** Writes an embedded `.ico` file to `C:\ProgramData\.ico` and creates the registry key `HKLM\SOFTWARE\Classes\.dlock\DefaultIcon` with `(Default)` set to the icon path, associating `.dlock` encrypted files with a custom icon. 7. **Process and service termination.** Enumerates all active Win32 services; for each matching the stop list, sets start type to `DISABLED` and sends a stop command. Targeted services include: `windefend`, `vss`, `swprv`, `wbengine`, `mssearch`, `vmcompute`, `vmms`, `adws`, `ntds`, `kdc`. Enumerates all running processes and terminates matches (skipping its own PID). Targeted processes include: `msmpeng`, `securityhealthservice`, `smartscreen`, `onedrive`, `dropbox`, `googledrivefs`, `owncloud`, `anydesk`, `putty`, `mstsc`, `rustdesk`, `explorer`, `powershell`, `taskmgr`, `cmd`. 8. **Event log clearing.** Three complementary methods: API-based clearing, registry manipulation, and full channel enumeration — covering third-party application logs and custom diagnostic channels. Existing entries are cleared, future recording is disabled, and access permissions are locked down. 9. **Directory traversal and encryption.** Two-tier exclusion system: - **Tier 1 (pre-traversal):** Top-level directories matching `\users\*\appdata`, `program files (x86)\`, `program files\`, `programdata\` are skipped entirely. - **Tier 2 (during-traversal):** Sub-path exclude list applied granularly during recursive enumeration. Thread count = 2 × CPU core count. A dedicated monitoring/dispatch thread per drive batch gates file dispatch based on system resource utilisation thresholds (hardcoded). Worker threads already encrypting are not interrupted; only new dispatch is throttled. - **File content:** XChaCha20 stream cipher. - **Key encapsulation:** Curve25519 ECDH + XSalsa20-Poly1305 via NaCl `crypto_box`. - **Random generation:** Windows CryptoAPI. 1. **Ransom note deployment.** - **Text note:** `HOW_RECOVER..txt` — dropped in every encrypted directory, but only on the second pass of the directory processing loop (gated by iteration counter). Will not appear in single-iteration test scenarios. - **HTML note:** `RECOVERY_CHAT..html` — dropped to all drive root directories and all Desktop folders. Self-contained SPA implementing end-to-end encrypted chat, paginated data leak blog, and AWS S3-compatible file browser. 2. **Wallpaper modification.** Generates a custom BMP at runtime using victim's screen resolution. Written to `C:\ProgramData\.bmp` (Vista+) or `C:\Documents and Settings\All Users\Application Data\.bmp` (XP). Persisted at `HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Wallpaper`. 3. **Self-deletion.** Creates a batch script that loops until the malware binary is deleted, then removes itself. **Encryption.** Hybrid cryptographic design:Operator public key is 33 bytes with a `03` SEC1 compressed-point prefix (borrowed from Bitcoin/secp256k1). The malware validates the prefix against a lookup table accepting `00`, `02`, `03`, `04`, `05`. Only the remaining 32 bytes are used in Curve25519 ECDH. Per-file ephemeral Curve25519 keypair is generated; zero `crypto_box` nonce is safe because the shared secret is unique per file.**Tiered encryption policy** (config rule: `1000,05052429880,025124288000,010524288000,F991114288000`), last matching rule wins: | Rule | Percent | Threshold | Behaviour | | ------------- | ------- | ---------- | ----------------------------------------- | | 1000 | 100% | ≥ 0 bytes | Full encryption | | 05052429880 | 50% | ≥ \~50 MB | Distributed chunk encryption | | 025124288000 | 25% | ≥ \~118 MB | Distributed chunk encryption | | 010524288000 | 10% | ≥ \~500 MB | Distributed chunk encryption | | F991114288000 | Chunked | ≥ \~1 GB | Full-chunk mode with calculated intervals | For partial encryption, 512-byte blocks are encrypted at regular intervals. A structured metadata footer is appended to each encrypted file containing: cleartext ephemeral Curve25519 public key (33 bytes), `dDlK` magic marker for decryption validation, `FA` flag (present for sequential/contiguous block encryption, absent for intermittent/skip), 8-byte chunk parameters, and a 12-byte random file identifier. ### Decentralized recovery infrastructure **Blockchain (Polygon):** Two smart contracts store censorship-resistant configuration: - **Chat proxy:** `0x8EF7c3e531d871D3B9D559722DE77EB1dEc19dAe`, function selector `0x933a9ce8` — stores proxy server URL. - **Blog:** `0x757984507c82c8dA1d3969c535dB5706eEE6426C`, function selector `0xd4070542` — stores actor's blog posts (offset/limit pagination, returns titles, bodies, timestamps, image URLs, file attachment links). The HTML page issues `eth_call` read-only requests (no wallet required) to six public Polygon RPC endpoints for redundancy: `polygon-bor-rpc.publicnode[.]com`, `polygon.drpc[.]org`, `polygon-pokt.nodies[.]app`, `polygon-rpc[.]com`, `1rpc[.]io/matic`, `polygon.meowrpc[.]com`. **Session messenger:** Victim's Session identity is deterministically derived from sign-in credentials (ed25519 keypair with `05` prefix). Chat messages routed through Session's onion-routed, swarm-based protocol. The proxy server (URL from blockchain) relays between victim's browser and Session swarm nodes. **Wasabi/S3 file browser:** The HTML application parses Wasabi credentials from URIs, generates AWS4-HMAC-SHA256 signed requests, lists bucket contents with folder navigation, and generates pre-signed download URLs — enabling browsable access to leaked files without a web server. ## 4\. Mitigation & containment ### P1 — Within 24 hours - **Block known infrastructure at network egress:** - Block the six Polygon RPC endpoints: `polygon-bor-rpc.publicnode.com`, `polygon.drpc.org`, `polygon-pokt.nodies.app`, `polygon-rpc.com`, `1rpc.io/matic`, `polygon.meowrpc.com`. These are legitimate public endpoints; blocking them prevents the recovery chat from functioning but may impact legitimate blockchain access. Assess business need before blocking. - Block known leak site domains: `deadlock.liveblog365.com`, `dlock.liveblog365.com`, `deadblogdbdu5wprek7wa2o4ce7rnt6u6ntqeud3hzjjcveosgpsqqd.onion`, `deadlockblog.great-site.net`, `deadlockblog.medianewsonline.com`. - Block the two Polygon smart contract addresses at any web3 gateway/proxy: `0x8EF7c3e531d871D3B9D559722DE77EB1dEc19dAe`, `0x757984507c82c8dA1d3969c535dB5706eEE6426C`. - **EDR/SIEM alerting on DeadLock-specific behaviours:** - Process creating a randomly named 8-character `.cmd` file and invoking `ShellExecuteW` with `RunAs` verb (up to 10 retries). - Modification of `HKLM\SOFTWARE\Classes\.dlock\DefaultIcon` registry key. - Modification of `HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Wallpaper` registry key. - Batch script self-deleting the invoking executable in a loop. - Mass process termination targeting: `msmpeng`, `securityhealthservice`, `smartscreen`, `onedrive`, `dropbox`, `googledrivefs`, `anydesk`, `explorer`, `powershell`, `taskmgr`, `cmd`. - Service start type set to `DISABLED` for: `windefend`, `vss`, `swprv`, `wbengine`, `vmcompute`, `vmms`, `adws`, `ntds`, `kdc`. - Event log clearing across all channels followed by access permission lockdown. - File with SHA-256 `a1fdf65020ce4a0f0940c793c6425baf8a0b994ec48b9baaf72788661a9d29f4`. - **Protect critical services:** Ensure `windefend`, `vss`, `swprv`, `wbengine` services cannot be disabled by non-system processes via EDR tamper protection and Windows Service hardening. ### P2 — Within 72 hours - **Enable Attack Surface Reduction (ASR) rules** in block mode, particularly rules blocking credential stealing, obfuscated/macro-based code execution, and executable creation. Microsoft recommends assessing user impact via Vulnerability Management recommendation details before deploying in block mode. - **Hunt for `.dlock` file extensions** across file shares, backup repositories, and endpoint telemetry. - **Hunt for `HOW_RECOVER.*.txt` and `RECOVERY_CHAT.*.html` files** across file servers and endpoints. - **Hunt for `.ico` and `.bmp` files written to `C:\ProgramData\`** with patterns matching `.ico` or `.bmp`. - **Verify backup integrity** — DeadLock explicitly targets `vss`, `swprv`, `wbengine`; confirm offline/immutable backups exist and are not accessible from domain-joined endpoints. - **Restrict Session messenger and Tor/onion network egress** if not required for business purposes. ### P3 — Within 7 days - **Review Active Directory service exposure** — DeadLock targets `adws`, `ntds`, `kdc` services; ensure these run on dedicated DCs with restricted interactive login and monitoring. - **Validate event log forwarding** — DeadLock clears and disables local event logs; ensure logs are forwarded to a central SIEM in real-time so local clearing does not destroy forensic evidence. - **Review remote access tool governance** — DeadLock terminates `anydesk`, `putty`, `mstsc`, `rustdesk`; ensure these tools are inventoried and their unexpected termination triggers alerts. - **Incorporate DeadLock into incident response playbooks** — the decentralized infrastructure (Polygon blockchain, Session messenger) means traditional domain/infrastructure takedown is insufficient; negotiation and recovery paths differ from conventional ransomware. ## 5\. Indicators of compromise | Type | Value | Confidence | Source | | ---------------- | ------------------------------------------------------------------------ | ---------- | --------- | | SHA-256 | a1fdf65020ce4a0f0940c793c6425baf8a0b994ec48b9baaf72788661a9d29f4 | High | Microsoft | | URL | hxxps://deadlock\[.\]liveblog365\[.\]com | High | Microsoft | | URL | hxxps://dlock\[.\]liveblog365\[.\]com | High | Microsoft | | URL | hxxp://deadblogdbdu5wprek7wa2o4ce7rnt6u6ntqeud3hzjjcveosgpsqqd\[.\]onion | High | Microsoft | | URL | hxxps://deadlockblog\[.\]great-site\[.\]net | High | Microsoft | | URL | hxxps://deadlockblog\[.\]medianewsonline\[.\]com | High | Microsoft | | Domain | polygon-bor-rpc\[.\]publicnode\[.\]com | High | Microsoft | | Domain | polygon\[.\]drpc\[.\]org | High | Microsoft | | Domain | polygon-pokt\[.\]nodies\[.\]app | High | Microsoft | | Domain | polygon-rpc\[.\]com | High | Microsoft | | Domain | 1rpc\[.\]io | High | Microsoft | | Domain | polygon\[.\]meowrpc\[.\]com | High | Microsoft | | Ethereum address | 0x8EF7c3e531d871D3B9D559722DE77EB1dEc19dAe | High | Microsoft | | Ethereum address | 0x757984507c82c8dA1d3969c535dB5706eEE6426C | High | Microsoft | ```iocs sha256 a1fdf65020ce4a0f0940c793c6425baf8a0b994ec48b9baaf72788661a9d29f4 url hxxps://deadlock[.]liveblog365[.]com url hxxps://dlock[.]liveblog365[.]com url hxxp://deadblogdbdu5wprek7wa2o4ce7rnt6u6ntqeud3hzjjcveosgpsqqd[.]onion url hxxps://deadlockblog[.]great-site[.]net url hxxps://deadlockblog[.]medianewsonline[.]com domain polygon-bor-rpc[.]publicnode[.]com domain polygon[.]drpc[.]org domain polygon-pokt[.]nodies[.]app domain polygon-rpc[.]com domain 1rpc[.]io domain polygon[.]meowrpc[.]com ethereum 0x8EF7c3e531d871D3B9D559722DE77EB1dEc19dAe ethereum 0x757984507c82c8dA1d3969c535dB5706eEE6426C ``` ### Behavioural indicators | Behaviour | Where to observe | Confidence | | ---------------------------------------------------------------------------------------------------------------- | --------------------------------------- | ---------- | | Creation of HKLM\\SOFTWARE\\Classes\\.dlock\\DefaultIcon registry key | Endpoint EDR / registry auditing | High | | Creation of HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Wallpaper registry value | Endpoint EDR / registry auditing | High | | Randomly named 8-char .cmd file executed via ShellExecuteW with RunAs verb, retried up to 10× | Endpoint EDR process creation telemetry | High | | Mass service disablement (windefend, vss, swprv, wbengine, vmcompute, vmms, adws, ntds, kdc) | Windows System event log / EDR | High | | Mass process termination (msmpeng, securityhealthservice, smartscreen, explorer, powershell, taskmgr, cmd, etc.) | Endpoint EDR | High | | Event log clearing across all channels with permission lockdown | Windows Event Log / EDR | High | | Files with .dlock extension appearing on shares or local disks | File server auditing / EDR | High | | HOW\_RECOVER.\*.txt files appearing in multiple directories (second-pass only) | File server auditing / EDR | High | | RECOVERY\_CHAT.\*.html files at drive roots and Desktop folders | File server auditing / EDR | High | | eth\_call JSON-RPC requests to Polygon RPC endpoints from endpoint browsers | Network egress / web proxy logs | High | | Batch script looping to delete own executable | Endpoint EDR / script logging | High | | Recycle bin silently emptied on all drives | Endpoint EDR / API monitoring | Medium | ## 6\. Detection ```yara rule DeadLock_Ransomware_Encryptor { meta: author = "Adverse Trace" date = "2026-08-10" reference = "https://www.microsoft.com/en-us/security/blog/2026/08/10/deadlock-ransomware-breaking-down-a-rust-based-encryptor-with-decentralized-recovery-infrastructure/" description = "Detects DeadLock ransomware encryptor based on configuration artefacts, crypto constants, and recovery infrastructure strings" strings: $magic_dDlK = "dDlK" ascii $pubkey = "03bf50bbf97c4e951e66ff12b689a37a3ce675b4921e254eae76da77573843e4a9" ascii $ext_dlock = ".dlock" ascii $note_txt = "HOW_RECOVER." ascii $note_html = "RECOVERY_CHAT." ascii $rpc1 = "polygon-bor-rpc.publicnode.com" ascii $rpc2 = "polygon.drpc.org" ascii $rpc3 = "polygon-pokt.nodies.app" ascii $rpc4 = "polygon-rpc.com" ascii $rpc5 = "1rpc.io/matic" ascii $rpc6 = "polygon.meowrpc.com" ascii $contract_proxy = "8EF7c3e531d871D3B9D559722DE77EB1dEc19dAe" ascii $contract_blog = "757984507c82c8dA1d3969c535dB5706eEE6426C" ascii $selector_chat = "933a9ce8" ascii $selector_blog = "d4070542" ascii $leak1 = "deadlock.liveblog365.com" ascii $leak2 = "dlock.liveblog365.com" ascii $leak3 = "deadlockblog.great-site.net" ascii $leak4 = "deadlockblog.medianewsonline.com" ascii condition: $magic_dDlK or $pubkey or ($ext_dlock and ($note_txt or $note_html)) or 3 of ($rpc*) or ($contract_proxy and $selector_chat) or ($contract_blog and $selector_blog) or any of ($leak*) } ``` ```yaml title: DeadLock Ransomware Behavioural Detection id: 7a3c1f2e-8b4d-4e6a-9c5f-1d2e3f4a5b6c status: experimental description: Detects DeadLock ransomware behaviours including .dlock icon registration, wallpaper modification, mass service disablement, and self-deleting batch execution author: Adverse Trace date: 2026/08/10 references: - https://www.microsoft.com/en-us/security/blog/2026/08/10/deadlock-ransomware-breaking-down-a-rust-based-encryptor-with-decentralized-recovery-infrastructure/ logsource: product: windows category: registry_event detection: selection_dlock_icon: TargetObject|contains: 'HKLM\SOFTWARE\Classes\.dlock\DefaultIcon' selection_wallpaper: TargetObject|contains: 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Wallpaper' condition: selection_dlock_icon or selection_wallpaper falsepositives: - Legitimate icon association changes (unlikely for .dlock) - Group Policy wallpaper deployment (correlate with GPO context) level: critical ``` ```yaml title: DeadLock Ransomware Service Disablement id: 8b4d2f3e-9c5e-4f7b-ad6a-2e3f4a5b6c7d status: experimental description: Detects mass service disablement pattern matching DeadLock ransomware configuration author: Adverse Trace date: 2026/08/10 references: - https://www.microsoft.com/en-us/security/blog/2026/08/10/deadlock-ransomware-breaking-down-a-rust-based-encryptor-with-decentralized-recovery-infrastructure/ logsource: product: windows service: system detection: selection_service_stop: EventID: 7040 ServiceName|in: - windefend - vss - swprv - wbengine - mssearch - vmcompute - vmms - adws - ntds - kdc condition: selection_service_stop falsepositives: - Legitimate administrator disabling services (correlate with change management) level: high ``` ```yaml title: DeadLock Ransomware UAC Bypass Attempt id: 9c5e3a4f-ad6a-4b8c-be7b-3f4a5b6c7d8e status: experimental description: Detects DeadLock's batch-script-based UAC elevation technique using randomly named .cmd files with RunAs verb author: Adverse Trace date: 2026/08/10 references: - https://www.microsoft.com/en-us/security/blog/2026/08/10/deadlock-ransomware-breaking-down-a-rust-based-encryptor-with-decentralized-recovery-infrastructure/ logsource: product: windows category: process_creation detection: selection_cmd_file: CommandLine|re: '.*\\[A-Z]{8}\.cmd.*' CommandLine|contains: 'runas' condition: selection_cmd_file falsepositives: - Legitimate elevation scripts using 8-character uppercase names (unlikely) level: high ``` ## 7\. Sources - Microsoft Security Blog, "DeadLock ransomware: Breaking down a Rust-based encryptor with decentralized recovery infrastructure," https://www.microsoft.com/en-us/security/blog/2026/08/10/deadlock-ransomware-breaking-down-a-rust-based-encryptor-with-decentralized-recovery-infrastructure/, 2026-08-10 ## 8\. Adverse Trace position DeadLock represents a meaningful evolution in ransomware operational resilience through its use of Polygon blockchain smart contracts for infrastructure configuration and the Session messenger for victim negotiation — making traditional domain/infrastructure takedowns insufficient. The encryptor itself is technically competent: sound hybrid cryptography (Curve25519/XChaCha20/NaCl crypto\_box), resource-aware throttling to evade behavioural detection, tiered partial encryption for speed, and comprehensive anti-forensics. The threat is active with 80+ published victims and a European concentration exceeding 50%, directly relevant to EMEA financial services. Attribution to Lynx and INC affiliates is single-sourced (Microsoft only) and unconfirmed given the absence of MITRE ATT&CK profiles for all named actors. We are treating this as a high-priority emerging threat. Next steps: we will monitor for additional DeadLock samples and variant changes, track the two Polygon smart contracts for configuration updates, and assess whether the Lynx/INC affiliate relationship is corroborated by additional reporting. Clients should prioritise P1 network blocks and EDR detection rules immediately. --- [Read the original source →](https://www.microsoft.com/en-us/security/blog/2026/08/10/deadlock-ransomware-breaking-down-a-rust-based-encryptor-with-decentralized-recovery-infrastructure/?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*