> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Ransomware: Deadlock named UNION FA (GR) - URL: https://f4n6.co.uk/security-feed/ransomware-deadlock-named-union-fa-gr/ - Published: 2026-10-02T15:55:28.000Z - Updated: 2026-10-02T15:55:28.000Z - Author: Jeff Davies - Tags: #security-feed, Deadlock ## 1\. Executive summary The Deadlock ransomware group listed UNION FA, a Greek accounting, tax and consulting firm operating at rogdianakis.gr, on its leak site on 2026-10-02\. The listing names the victim, the country (GR) and the domain; it does not publish a sample, an initial-access vector, a ransom demand or any proof-of-data artefact. Deadlock has no MITRE ATT&CK profile in our reference data, so the attribution to that group rests on the leak-site listing alone and is unconfirmed. The direct risk to EMEA financial services clients is second-order: UNION FA is an accounting and tax adviser, so its client book is the exposure, and firms that share an adviser, an outsourced payroll or a tax-filing pipeline with it should treat that relationship as potentially compromised until the victim confirms otherwise. No CVE, no CISA KEV entry and no exploitation state applies to this item. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ----------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 28: ICT third-party risk, general principles | The victim is an external accounting, tax and consulting provider, so client financial data sits with a third party rather than in-house | Clients using UNION FA or a comparable adviser must be able to evidence that the provider's ICT risk is assessed and that contractual exit or substitution is possible | | DORA Art. 30: key contractual provisions with ICT third-party providers | Same third-party relationship; the item gives no indication that breach notification, audit or data-return terms exist | Where UNION FA or an equivalent provider holds client records, the contract needs notification, cooperation and data-return clauses before the next renewal, not after an incident | | NIS2 Art. 21(2)(d): supply chain security measures | The compromised entity is a supplier in the client's chain, not the client itself | In-scope entities must be able to show supply chain security measures covering advisers and outsourced finance functions | DORA Art. 17, 18 and 19 are not engaged on the facts available: the item is a leak-site listing, not a confirmed ICT incident at a client, and no classification or reporting duty can be triggered by a third party's public listing alone. UK NIS 2018 is not engaged; the victim is a Greek entity and no UK OES or RDSP is identified. ## 3\. Technical analysis & attack chain The source material does not support a numbered attack chain. What exists is a leak-site listing, and the confirmed facts stop there. Confirmed from the listing: 1. Deadlock posted UNION FA to its leak site on 2026-10-02 at 07:50 UTC. 2. The listing records the victim name (UNION FA), the country (GR) and the domain rogdianakis.gr. 3. rogdianakis.gr resolves to Union FA (Union Financial Associates), an accounting, tax and consulting firm whose CEO is named as Giorgos Rogdianakis. Nothing else is confirmed. The listing carries no initial-access vector, no exploited component or CVE, no malware sample, no persistence mechanism, no command-and-control detail, no lateral-movement path, no exfiltration evidence and no ransom figure. The related source for Caspian One is a separate Deadlock victim in a different country and sector and does not describe a shared toolset, so it cannot be used to infer how UNION FA was accessed. Two things are worth separating for defenders. First, the sector pattern: Deadlock's indexed victims in this batch include an IT services and recruitment provider (Caspian One) and an accounting firm (UNION FA), which is consistent with a group that takes whatever mid-market professional-services target it can reach rather than running a sector-specific campaign. That is an observation about the victim set, not a claim about tradecraft. Second, the exposure model: an accounting and tax adviser holds client ledgers, payroll data, tax filings and identity documents for many businesses at once, so a single successful intrusion at the adviser propagates to every client whose records it holds. That is the reason this listing matters to financial services readers even though the victim is small. Confidence caveats. The attribution to Deadlock is single-sourced to the ransomware.live index and is unconfirmed; Deadlock has no MITRE ATT&CK profile in our reference data, so we cannot map the group to known techniques. The link between the domain rogdianakis.gr and the legal entity Union FA is asserted in the item and is not independently corroborated. The claim that the firm provides accounting, tax and consulting services is likewise single-sourced. Treat all three as unverified until the victim or a national authority confirms. ## 4\. Mitigation & containment P1, within 24 hours. - If your firm uses UNION FA or any adviser reachable through rogdianakis.gr, contact them out of band (a phone number you already hold, not one from the domain) and ask directly whether client data was accessed. Do not wait for a public statement. - Freeze new data flows to that provider until they answer: pause file transfers, shared drives, API integrations and any automated tax or payroll submission that routes through them. - Pull the last 90 days of authentication logs for any account, service principal or shared mailbox that exchanges data with the provider and look for logins from unexpected geographies or at unusual hours. - If credentials were ever shared with the provider (a portal login, an SFTP account, a shared mailbox), rotate them now and revoke sessions. Assume shared credentials are burned. P2, within 72 hours. - Review the contract with the provider against DORA Art. 30 expectations: notification timelines, cooperation during an incident, audit rights and data return or deletion on exit. Where those clauses are missing, raise it with procurement before renewal. - Map which of your records the provider holds and classify them. Client identity documents and tax filings carry different notification duties from anonymised ledgers, and you cannot scope a response without that inventory. - Check whether the provider appears in any other client's supply chain in your group. Concentration risk is the issue here: if three business units use the same adviser, one incident hits all three. P3, within 7 days. - Add the provider to your third-party risk register with the incident date and the current status, and set a review date. - Where the provider cannot evidence controls, start a substitution plan for the highest-sensitivity data flows first. - Brief finance and tax teams on the callback procedure for any request that changes bank details or filing instructions, since a compromised adviser is a natural pretext for payment-diversion fraud. No vendor patch applies. There is no CVE in this item and no fixed version to pin. ## 5\. Indicators of compromise No indicators of compromise available in the source material. The listing provides a victim name, a country and a domain, none of which are atomic indicators of the intrusion itself. The sources describe no observable behaviours either: there is no authentication pattern, device registration, process activity or network signature to report. The only machine-pivotable artefact is the victim domain, which is a victim identifier rather than an attacker indicator and is not reproduced here as an IOC. ## 6\. Detection Insufficient indicators to author detection rules. The source material contains no malware strings, no command-line flags, no mutex or scheduled-task names, no file paths, no registry keys, no ransom-note text and no network infrastructure. A YARA or Sigma rule built from this item would match the reporting rather than the threat, so none is emitted. ## 7\. Sources - Ransomware.live, "Ransomware: Deadlock named UNION FA (GR)", https://www.ransomware.live/id/VU5JT04gRkFARGVhZGxvY2s=, published 2026-10-02. - Ransomware.live, "Victim: UNION FA – Deadlock", https://www.ransomware.live/id/VU5JT04gRkFARGVhZGxvY2s=, undated index page. - Ransomware.live, "Ransomware: Deadlock named Caspian One (AZ)", https://www.ransomware.live/id/Q2FzcGlhbiBPbmVARGVhZGxvY2s=, undated index page (context only; separate victim). ## 8\. Adverse Trace position We assess this as a low-severity item for most EMEA financial services clients and a moderate one for any firm that outsources accounting, tax or payroll to UNION FA or to a provider reachable through rogdianakis.gr. The severity is bounded by what the source does not contain: no CVE, no CISA KEV entry, no exploitation state, no sample and no proof of data. The attribution to Deadlock is unconfirmed and single-sourced, and Deadlock has no MITRE ATT&CK profile in our reference data, so we are not mapping techniques to it. Our client-impact assessment is that the exposure runs through the provider relationship rather than through any technical control a client can patch, which is why the P1 actions are contractual and credential-based rather than endpoint-based. Adverse Trace will monitor the leak site for follow-up posts, for any proof-of-data release naming UNION FA clients, and for Deadlock listings that name financial services entities in EMEA; we will reissue this advisory if the victim confirms an intrusion, if client data is published, or if a second independent source corroborates the attribution. Clients who need the provider-relationship review run against DORA Art. 28 and Art. 30 should contact their Adverse Trace analyst. --- [Read the original source →](https://www.ransomware.live/id/VU5JT04gRkFARGVhZGxvY2s=?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*