DeadLock ransomware: Breaking down a Rust-based encryptor with decentralized recovery infrastructure

1. Executive summary

Microsoft Threat Intelligence has published a detailed technical analysis of DeadLock, a Rust-based ransomware encryptor in active deployment since July 2025. DeadLock employs double extortion and has published over 80 victim organisations on its leak site as of July 2026, with more than half of claimed victims in Europe. The operation is notable for its decentralized recovery infrastructure — using the Polygon blockchain to store proxy URLs and blog content, and the Session messaging network for victim negotiation — which significantly complicates takedown. Microsoft attributes deployment to affiliates of the Lynx and INC ransomware ecosystems; however, neither DeadLock, Lynx, nor INC has a confirmed MITRE ATT&CK profile, so this attribution must be treated as unconfirmed. EMEA financial services are exposed given the heavy European victim concentration, though no financial-services-specific targeting is described.

2. Regulatory framing

No specific NIS2 or UK NIS article is directly engaged beyond general incident-management obligations that apply to any ransomware event.

3. Technical analysis & attack chain

Attribution caveat: Microsoft states DeadLock is deployed by affiliates of the Lynx and INC ransomware ecosystems. Neither Lynx, INC, nor DeadLock has a MITRE ATT&CK profile in the verified reference data; attribution is unconfirmed and single-sourced (Microsoft only). Treat with appropriate caution for enforcement decisions.

Attack chain (confirmed from Microsoft analysis)

1. Initial execution and configuration decryption. The encryptor decrypts an embedded configuration blob using XOR with an 8-byte key. The configuration contains: victim UID, operator public key (03bf50bbf97c4e951e66ff12b689a37a3ce675b4921e254eae76da77573843e4a9), encryption rules, language exclude list, process stop list, service stop list, file/directory/sub-path exclude lists, text ransom note, and full HTML/JS recovery chat page.
2. Geofencing exit check. The malware queries system default and UI language. If either matches the exclude list (LANGIDs: 1049, 1058, 1059, 1064, 1065, 1067, 1068, 1079, 1087, 1088, 1090, 1114, 2072, 2092, 2115, 8193, 9217), the malware self-deletes immediately without encrypting.
3. Privilege elevation (if not elevated, no command-line argument). The malware generates a randomly named .cmd file (8 uppercase characters, e.g. ESYEKQSY.cmd) and executes it via ShellExecuteW with the RunAs verb, triggering UAC. Retries up to 10 times if denied. In dynamic analysis, this elevation did not succeed; full preparation requires an already-elevated context. If a target directory path is passed as a command-line argument, the malware skips all preparation and jumps directly to encryption.
4. Privilege expansion. When elevated, the malware enables SeDebugPrivilege, SeRestorePrivilege, SeBackupPrivilege, SeTakeOwnershipPrivilege, SeAuditPrivilege, and SeSecurityPrivilege.
5. Recycle bin clearing. Silently empties the recycle bin on all drives.
6. Icon registration. Writes an embedded .ico file to C:\ProgramData\<UID>.ico and creates the registry key HKLM\SOFTWARE\Classes\.dlock\DefaultIcon with (Default) set to the icon path, associating .dlock encrypted files with a custom icon.
7. Process and service termination. Enumerates all active Win32 services; for each matching the stop list, sets start type to DISABLED and sends a stop command. Targeted services include: windefend, vss, swprv, wbengine, mssearch, vmcompute, vmms, adws, ntds, kdc. Enumerates all running processes and terminates matches (skipping its own PID). Targeted processes include: msmpeng, securityhealthservice, smartscreen, onedrive, dropbox, googledrivefs, owncloud, anydesk, putty, mstsc, rustdesk, explorer, powershell, taskmgr, cmd.
8. Event log clearing. Three complementary methods: API-based clearing, registry manipulation, and full channel enumeration — covering third-party application logs and custom diagnostic channels. Existing entries are cleared, future recording is disabled, and access permissions are locked down.
9. Directory traversal and encryption. Two-tier exclusion system: - Tier 1 (pre-traversal): Top-level directories matching \users\*\appdata, program files (x86)\, program files\, programdata\ are skipped entirely. - Tier 2 (during-traversal): Sub-path exclude list applied granularly during recursive enumeration.

Thread count = 2 × CPU core count. A dedicated monitoring/dispatch thread per drive batch gates file dispatch based on system resource utilisation thresholds (hardcoded). Worker threads already encrypting are not interrupted; only new dispatch is throttled.

• File content: XChaCha20 stream cipher.
• Key encapsulation: Curve25519 ECDH + XSalsa20-Poly1305 via NaCl crypto_box.
• Random generation: Windows CryptoAPI.
10. Ransom note deployment.
    • Text note: HOW_RECOVER.<UID>.txt — dropped in every encrypted directory, but only on the second pass of the directory processing loop (gated by iteration counter). Will not appear in single-iteration test scenarios.
    • HTML note: RECOVERY_CHAT.<UID>.html — dropped to all drive root directories and all Desktop folders. Self-contained SPA implementing end-to-end encrypted chat, paginated data leak blog, and AWS S3-compatible file browser.
11. Wallpaper modification. Generates a custom BMP at runtime using victim's screen resolution. Written to C:\ProgramData\<UID>.bmp (Vista+) or C:\Documents and Settings\All Users\Application Data\<UID>.bmp (XP). Persisted at HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Wallpaper.
12. Self-deletion. Creates a batch script that loops until the malware binary is deleted, then removes itself.

Encryption. Hybrid cryptographic design:Operator public key is 33 bytes with a 03 SEC1 compressed-point prefix (borrowed from Bitcoin/secp256k1). The malware validates the prefix against a lookup table accepting 00, 02, 03, 04, 05. Only the remaining 32 bytes are used in Curve25519 ECDH. Per-file ephemeral Curve25519 keypair is generated; zero crypto_box nonce is safe because the shared secret is unique per file.Tiered encryption policy (config rule: 1000,05052429880,025124288000,010524288000,F991114288000), last matching rule wins:

For partial encryption, 512-byte blocks are encrypted at regular intervals. A structured metadata footer is appended to each encrypted file containing: cleartext ephemeral Curve25519 public key (33 bytes), dDlK magic marker for decryption validation, FA flag (present for sequential/contiguous block encryption, absent for intermittent/skip), 8-byte chunk parameters, and a 12-byte random file identifier.

Decentralized recovery infrastructure

Blockchain (Polygon): Two smart contracts store censorship-resistant configuration:

• Chat proxy: 0x8EF7c3e531d871D3B9D559722DE77EB1dEc19dAe, function selector 0x933a9ce8 — stores proxy server URL.
• Blog: 0x757984507c82c8dA1d3969c535dB5706eEE6426C, function selector 0xd4070542 — stores actor's blog posts (offset/limit pagination, returns titles, bodies, timestamps, image URLs, file attachment links).

The HTML page issues eth_call read-only requests (no wallet required) to six public Polygon RPC endpoints for redundancy: polygon-bor-rpc.publicnode[.]com, polygon.drpc[.]org, polygon-pokt.nodies[.]app, polygon-rpc[.]com, 1rpc[.]io/matic, polygon.meowrpc[.]com.

Session messenger: Victim's Session identity is deterministically derived from sign-in credentials (ed25519 keypair with 05 prefix). Chat messages routed through Session's onion-routed, swarm-based protocol. The proxy server (URL from blockchain) relays between victim's browser and Session swarm nodes.

Wasabi/S3 file browser: The HTML application parses Wasabi credentials from URIs, generates AWS4-HMAC-SHA256 signed requests, lists bucket contents with folder navigation, and generates pre-signed download URLs — enabling browsable access to leaked files without a web server.

4. Mitigation & containment

P1 — Within 24 hours

• Block known infrastructure at network egress:
• Block the six Polygon RPC endpoints: polygon-bor-rpc.publicnode.com, polygon.drpc.org, polygon-pokt.nodies.app, polygon-rpc.com, 1rpc.io/matic, polygon.meowrpc.com. These are legitimate public endpoints; blocking them prevents the recovery chat from functioning but may impact legitimate blockchain access. Assess business need before blocking.
• Block known leak site domains: deadlock.liveblog365.com, dlock.liveblog365.com, deadblogdbdu5wprek7wa2o4ce7rnt6u6ntqeud3hzjjcveosgpsqqd.onion, deadlockblog.great-site.net, deadlockblog.medianewsonline.com.
• Block the two Polygon smart contract addresses at any web3 gateway/proxy: 0x8EF7c3e531d871D3B9D559722DE77EB1dEc19dAe, 0x757984507c82c8dA1d3969c535dB5706eEE6426C.
• EDR/SIEM alerting on DeadLock-specific behaviours:
• Process creating a randomly named 8-character .cmd file and invoking ShellExecuteW with RunAs verb (up to 10 retries).
• Modification of HKLM\SOFTWARE\Classes\.dlock\DefaultIcon registry key.
• Modification of HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Wallpaper registry key.
• Batch script self-deleting the invoking executable in a loop.
• Mass process termination targeting: msmpeng, securityhealthservice, smartscreen, onedrive, dropbox, googledrivefs, anydesk, explorer, powershell, taskmgr, cmd.
• Service start type set to DISABLED for: windefend, vss, swprv, wbengine, vmcompute, vmms, adws, ntds, kdc.
• Event log clearing across all channels followed by access permission lockdown.
• File with SHA-256 a1fdf65020ce4a0f0940c793c6425baf8a0b994ec48b9baaf72788661a9d29f4.
• Protect critical services: Ensure windefend, vss, swprv, wbengine services cannot be disabled by non-system processes via EDR tamper protection and Windows Service hardening.

P2 — Within 72 hours

• Enable Attack Surface Reduction (ASR) rules in block mode, particularly rules blocking credential stealing, obfuscated/macro-based code execution, and executable creation. Microsoft recommends assessing user impact via Vulnerability Management recommendation details before deploying in block mode.
• Hunt for .dlock file extensions across file shares, backup repositories, and endpoint telemetry.
• Hunt for HOW_RECOVER.*.txt and RECOVERY_CHAT.*.html files across file servers and endpoints.
• Hunt for .ico and .bmp files written to C:\ProgramData\ with patterns matching <UID>.ico or <UID>.bmp.
• Verify backup integrity — DeadLock explicitly targets vss, swprv, wbengine; confirm offline/immutable backups exist and are not accessible from domain-joined endpoints.
• Restrict Session messenger and Tor/onion network egress if not required for business purposes.

P3 — Within 7 days

• Review Active Directory service exposure — DeadLock targets adws, ntds, kdc services; ensure these run on dedicated DCs with restricted interactive login and monitoring.
• Validate event log forwarding — DeadLock clears and disables local event logs; ensure logs are forwarded to a central SIEM in real-time so local clearing does not destroy forensic evidence.
• Review remote access tool governance — DeadLock terminates anydesk, putty, mstsc, rustdesk; ensure these tools are inventoried and their unexpected termination triggers alerts.
• Incorporate DeadLock into incident response playbooks — the decentralized infrastructure (Polygon blockchain, Session messenger) means traditional domain/infrastructure takedown is insufficient; negotiation and recovery paths differ from conventional ransomware.

5. Indicators of compromise

sha256  a1fdf65020ce4a0f0940c793c6425baf8a0b994ec48b9baaf72788661a9d29f4
url  hxxps://deadlock[.]liveblog365[.]com
url  hxxps://dlock[.]liveblog365[.]com
url  hxxp://deadblogdbdu5wprek7wa2o4ce7rnt6u6ntqeud3hzjjcveosgpsqqd[.]onion
url  hxxps://deadlockblog[.]great-site[.]net
url  hxxps://deadlockblog[.]medianewsonline[.]com
domain  polygon-bor-rpc[.]publicnode[.]com
domain  polygon[.]drpc[.]org
domain  polygon-pokt[.]nodies[.]app
domain  polygon-rpc[.]com
domain  1rpc[.]io
domain  polygon[.]meowrpc[.]com
ethereum  0x8EF7c3e531d871D3B9D559722DE77EB1dEc19dAe
ethereum  0x757984507c82c8dA1d3969c535dB5706eEE6426C

Behavioural indicators

6. Detection

rule DeadLock_Ransomware_Encryptor {
    meta:
        author = "Adverse Trace"
        date = "2026-08-10"
        reference = "https://www.microsoft.com/en-us/security/blog/2026/08/10/deadlock-ransomware-breaking-down-a-rust-based-encryptor-with-decentralized-recovery-infrastructure/"
        description = "Detects DeadLock ransomware encryptor based on configuration artefacts, crypto constants, and recovery infrastructure strings"

    strings:
        $magic_dDlK = "dDlK" ascii
        $pubkey = "03bf50bbf97c4e951e66ff12b689a37a3ce675b4921e254eae76da77573843e4a9" ascii
        $ext_dlock = ".dlock" ascii
        $note_txt = "HOW_RECOVER." ascii
        $note_html = "RECOVERY_CHAT." ascii
        $rpc1 = "polygon-bor-rpc.publicnode.com" ascii
        $rpc2 = "polygon.drpc.org" ascii
        $rpc3 = "polygon-pokt.nodies.app" ascii
        $rpc4 = "polygon-rpc.com" ascii
        $rpc5 = "1rpc.io/matic" ascii
        $rpc6 = "polygon.meowrpc.com" ascii
        $contract_proxy = "8EF7c3e531d871D3B9D559722DE77EB1dEc19dAe" ascii
        $contract_blog = "757984507c82c8dA1d3969c535dB5706eEE6426C" ascii
        $selector_chat = "933a9ce8" ascii
        $selector_blog = "d4070542" ascii
        $leak1 = "deadlock.liveblog365.com" ascii
        $leak2 = "dlock.liveblog365.com" ascii
        $leak3 = "deadlockblog.great-site.net" ascii
        $leak4 = "deadlockblog.medianewsonline.com" ascii

    condition:
        $magic_dDlK or
        $pubkey or
        ($ext_dlock and ($note_txt or $note_html)) or
        3 of ($rpc*) or
        ($contract_proxy and $selector_chat) or
        ($contract_blog and $selector_blog) or
        any of ($leak*)
}

title: DeadLock Ransomware Behavioural Detection
id: 7a3c1f2e-8b4d-4e6a-9c5f-1d2e3f4a5b6c
status: experimental
description: Detects DeadLock ransomware behaviours including .dlock icon registration, wallpaper modification, mass service disablement, and self-deleting batch execution
author: Adverse Trace
date: 2026/08/10
references:

    - https://www.microsoft.com/en-us/security/blog/2026/08/10/deadlock-ransomware-breaking-down-a-rust-based-encryptor-with-decentralized-recovery-infrastructure/
logsource:
    product: windows
    category: registry_event
detection:
    selection_dlock_icon:
        TargetObject|contains: 'HKLM\SOFTWARE\Classes\.dlock\DefaultIcon'
    selection_wallpaper:
        TargetObject|contains: 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Wallpaper'
    condition: selection_dlock_icon or selection_wallpaper
falsepositives:

    - Legitimate icon association changes (unlikely for .dlock)
    - Group Policy wallpaper deployment (correlate with GPO context)
level: critical

title: DeadLock Ransomware Service Disablement
id: 8b4d2f3e-9c5e-4f7b-ad6a-2e3f4a5b6c7d
status: experimental
description: Detects mass service disablement pattern matching DeadLock ransomware configuration
author: Adverse Trace
date: 2026/08/10
references:

    - https://www.microsoft.com/en-us/security/blog/2026/08/10/deadlock-ransomware-breaking-down-a-rust-based-encryptor-with-decentralized-recovery-infrastructure/
logsource:
    product: windows
    service: system
detection:
    selection_service_stop:
        EventID: 7040
        ServiceName|in:

            - windefend
            - vss
            - swprv
            - wbengine
            - mssearch
            - vmcompute
            - vmms
            - adws
            - ntds
            - kdc
    condition: selection_service_stop
falsepositives:

    - Legitimate administrator disabling services (correlate with change management)
level: high

title: DeadLock Ransomware UAC Bypass Attempt
id: 9c5e3a4f-ad6a-4b8c-be7b-3f4a5b6c7d8e
status: experimental
description: Detects DeadLock's batch-script-based UAC elevation technique using randomly named .cmd files with RunAs verb
author: Adverse Trace
date: 2026/08/10
references:

    - https://www.microsoft.com/en-us/security/blog/2026/08/10/deadlock-ransomware-breaking-down-a-rust-based-encryptor-with-decentralized-recovery-infrastructure/
logsource:
    product: windows
    category: process_creation
detection:
    selection_cmd_file:
        CommandLine|re: '.*\\[A-Z]{8}\.cmd.*'
        CommandLine|contains: 'runas'
    condition: selection_cmd_file
falsepositives:

    - Legitimate elevation scripts using 8-character uppercase names (unlikely)
level: high

7. Sources

• Microsoft Security Blog, "DeadLock ransomware: Breaking down a Rust-based encryptor with decentralized recovery infrastructure," https://www.microsoft.com/en-us/security/blog/2026/08/10/deadlock-ransomware-breaking-down-a-rust-based-encryptor-with-decentralized-recovery-infrastructure/, 2026-08-10

8. Adverse Trace position

DeadLock represents a meaningful evolution in ransomware operational resilience through its use of Polygon blockchain smart contracts for infrastructure configuration and the Session messenger for victim negotiation — making traditional domain/infrastructure takedowns insufficient. The encryptor itself is technically competent: sound hybrid cryptography (Curve25519/XChaCha20/NaCl crypto_box), resource-aware throttling to evade behavioural detection, tiered partial encryption for speed, and comprehensive anti-forensics. The threat is active with 80+ published victims and a European concentration exceeding 50%, directly relevant to EMEA financial services. Attribution to Lynx and INC affiliates is single-sourced (Microsoft only) and unconfirmed given the absence of MITRE ATT&CK profiles for all named actors. We are treating this as a high-priority emerging threat. Next steps: we will monitor for additional DeadLock samples and variant changes, track the two Polygon smart contracts for configuration updates, and assess whether the Lynx/INC affiliate relationship is corroborated by additional reporting. Clients should prioritise P1 network blocks and EDR detection rules immediately.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.