DeadLock Ransomware: Microsoft Details New TTPs

Introduction

Microsoft Threat Intelligence has released a detailed analysis of DeadLock ransomware, an emerging financially motivated threat that stands out for its use of decentralized infrastructure during extortion and recovery. For security teams, this matters because the model can make disruption harder and give operators more resilience during negotiations and leak-site operations.

First observed in July 2025, DeadLock has been linked to multiple groups, including an affiliate of the Lynx and INC ransomware ecosystems. As of July 2026, Microsoft says the operation has listed more than 80 victims, with over half in Europe.

What’s new in Microsoft’s analysis

Decentralized recovery and communication model

• DeadLock uses the Session messaging network along with blockchain-backed services.
• This supports victim communication, resource delivery, and data leak operations.
• The approach likely helps operators maintain continuity even if parts of their infrastructure are disrupted.

Technical behavior of the encryptor

• The malware is Rust-based and includes a resource-aware throttling mechanism to keep systems responsive during encryption.
• It decrypts an embedded configuration blob before execution.
• The encryptor can take a target path as a command-line argument to focus encryption on specific locations.

Geofencing and privilege escalation

• DeadLock checks system and UI language settings and exits on systems associated with former Soviet/CIS countries and some Middle Eastern regions.
• If not already elevated, it attempts UAC-based privilege elevation using a generated batch file.
• When running as administrator, it enables privileges such as SeDebugPrivilege and SeBackupPrivilege to expand access.

Defense evasion and recovery disruption

• The malware empties the Recycle Bin to reduce recovery options.
• It terminates processes and disables services that may block encryption or aid recovery.
• Notable targets include Windows Defender, Volume Shadow Copy, backup services, Hyper-V services, and some Active Directory-related services.

Impact on defenders

For IT and security administrators, the biggest takeaway is that DeadLock combines familiar ransomware tradecraft with a more resilient communication and extortion backend. That means defenders should prepare for both the encryption event and the post-compromise pressure tactics that follow.

Organizations in IT, manufacturing, logistics, hospitality, mining, and consumer goods should pay particular attention, especially those with operations in Europe.

Recommended next steps

• Review Microsoft’s published IOCs and Defender detections.
• Validate protections for Windows Defender, VSS, and backup services.
• Monitor for suspicious UAC prompts, service disablement, and mass file encryption behavior.
• Ensure offline or immutable backups are available and regularly tested.
• Hunt for signs of data exfiltration in addition to encryption activity.

Microsoft’s report is a useful reminder that ransomware operations continue to evolve not just in payload design, but also in the infrastructure that supports extortion.