Overview
Deadlock is a ransomware-as-a-service (RaaS) operation first observed in mid-2024. After an 11-month period of limited public activity, the group re-emerged in June 2026 with a significantly expanded victim count — 75 named victims in a single month, escalating to over 80 by early July. That surge represents a level of activity that places Deadlock in the top tier of active ransomware groups by victim volume.
The group’s technical signature is the use of blockchain infrastructure for command and control, combined with a kernel-level driver exploit for EDR removal before encryption. Both capabilities represent meaningful defensive evasion investments compared to commodity ransomware.
Attribution and Affiliations
No confirmed attribution to prior ransomware operations has been publicly established. Deadlock operates a RaaS model, meaning the core developers provide the ransomware builder, infrastructure, and leak site, while affiliates conduct intrusions and deploy the payload for a revenue share.
The group runs a dark web leak site where victims are named and evidence of data exfiltration is published to pressure payment. The site lists victim names, exfiltrated data samples, and countdown timers consistent with standard double-extortion operations.
Victim Profile
Geographic distribution: Approximately 57% of named victims are in the Europe-Russia region. North America, APAC, Latin America, and Middle East/Africa account for the remainder. The European concentration may reflect affiliate recruiting and initial access broker (IAB) relationships in that region.
Sector targeting: Manufacturing, construction, professional services, technology, and logistics appear most frequently in victim listings. No documented sector-specific focus or claimed specialisation — consistent with opportunistic affiliate-driven targeting rather than a curated strategic targeting list.
Victim size: Named victims in June-July 2026 include mid-market enterprises across multiple countries. No major enterprise or critical infrastructure names have been publicly confirmed in Deadlock’s victim list at time of writing, though the scope of actual intrusions may exceed what is named on the leak site (victims who pay before the deadline are typically not listed).
Technical Capabilities
Blockchain-Based C2 Infrastructure
Deadlock’s most distinctive technical feature is the use of Polygon blockchain smart contracts for command-and-control. The ransomware retrieves its operational instructions — C2 addresses, configuration parameters — from data stored on the Polygon blockchain rather than from traditional hardcoded domains or IP addresses.
Why this matters for defenders:
Traditional C2 detection and mitigation relies on several mechanisms:
- Domain blocklisting (blocklist the C2 domain and the malware cannot communicate)
- IP reputation feeds (flag connections to known malicious IPs)
- Takedown requests (convince the registrar or hosting provider to remove the C2 infrastructure)
None of these work against blockchain-hosted C2. The Polygon blockchain is decentralised, globally replicated, and has no single point of takedown. Blocking connections to Ethereum/Polygon node infrastructure would break a substantial amount of legitimate financial and Web3 application traffic. The malware reads its configuration from an immutable, publicly accessible, globally distributed ledger that no single party can remove.
An operator can update the C2 address stored in the smart contract — effectively rotating infrastructure — without any change to the deployed ransomware binary. Defenders who identify a C2 address and block it may find the address rotated in the next polling cycle.
Detection implications: Hunting for blockchain-based C2 requires monitoring for connections to Polygon RPC endpoints (polygon-rpc.com, Infura Polygon endpoints, Alchemy Polygon) from non-approved hosts. Workstations and servers that have no legitimate business reason to query Polygon JSON-RPC APIs should be flagged.
# Splunk — connections to Polygon RPC endpoints from enterprise hosts
index=proxy_logs (dest_host="*polygon-rpc.com" OR dest_host="polygon-mainnet.infura.io" OR dest_host="polygon-mainnet.g.alchemy.com")
| stats count BY src_ip, dest_host, _time
| where count > 3BYOVD — Kernel-Level EDR Disablement
Before encrypting files, Deadlock deploys a vulnerable driver to disable endpoint security products. The Bring Your Own Vulnerable Driver (BYOVD) technique loads a legitimate but vulnerable kernel driver (one with a known privilege escalation or memory write vulnerability) and exploits it to terminate EDR processes and disable their kernel callbacks.
At kernel privilege level, an attacker can directly terminate any process, unload any driver, and modify kernel data structures that endpoint security tools rely on to monitor system activity. Once EDR is removed, encryption can proceed without triggering behavioural detections.
Deadlock’s specific driver has not been publicly named in research published at time of writing. The BYOVD technique requires the driver to be signed (Microsoft won’t load unsigned drivers in modern Windows configurations), and threat actors have consistently sourced vulnerable drivers that carry valid signatures from legitimate software vendors.
Detection: BYOVD attacks are detectable through:
- Driver load events for known-vulnerable drivers (maintained by the Living Off the Land Drivers project at loldrivers.io)
- Kernel callback deregistration events in EDR telemetry
- Sudden disappearance of EDR process telemetry shortly before encryption activity
- Windows Event Log ID 7045 (new service installed) for the vulnerable driver
// KQL — Hunt for driver loads from known BYOVD driver hashes
DeviceDriverEvents
| join kind=inner (
externaldata(Hash:string) [h@"https://www.loldrivers.io/api/drivers.json"]
with (format="multijson", ingestionMapping='[{"Column":"Hash","Properties":{"Path":"$.KnownVulnerableSamples[*].SHA256"}}]')
) on $left.SHA256 == $right.Hash
| project Timestamp, DeviceName, DriverName, SHA256
| sort by Timestamp descEncryption and File Marking
Encrypted files receive the .dlock extension. A ransom note is dropped in each encrypted directory. The malware additionally modifies the desktop wallpaper with instructions to open the ransom note — a standard victim notification mechanism.
Deadlock claims to use “military-grade encryption” in its ransom notes. Specific encryption algorithms have not been publicly confirmed in independent analysis at time of writing. No decryptor has been published or offered by law enforcement.
Extortion Model
Deadlock uses double extortion: data is exfiltrated before encryption, and victims face ransom demands for both the decryption key and the deletion of the stolen data. Payment demands are in Bitcoin or Monero. Victims who do not pay within the countdown period have their data published on the leak site.
No documented negotiation patterns, average ransom demands, or typical payment rates have been publicly reported for Deadlock. Law enforcement has not publicly announced any action against the group.
Indicators of Compromise
File indicators:
.dlockextension on encrypted files- Ransom note filenames consistent with Deadlock (exact filenames not publicly confirmed at time of writing)
- Modified desktop wallpaper referencing ransom instructions
Network indicators:
- Connections to Polygon blockchain RPC endpoints from non-approved enterprise hosts
- DNS queries for Polygon infrastructure (
polygon-rpc.com,polygon-mainnet.g.alchemy.com) - Outbound connections on non-standard ports immediately preceding mass file modification events (data exfiltration staging)
Endpoint indicators:
- Kernel driver load events from unexpected paths before encryption
- Mass process terminations in short succession (EDR shutdown via BYOVD)
- High-volume file modification events (
.dlockextension appearing across multiple directories simultaneously) - Scheduled task or service creation immediately before or during encryption
Defensive Considerations
Attack surface reduction:
Deadlock affiliates use standard initial access methods (phishing, exposed RDP, VPN credential theft). Hardening external-facing authentication — MFA on VPN, patched RDP, phishing-resistant authentication — reduces affiliate entry paths.
BYOVD mitigation:
Microsoft’s Windows Defender Vulnerable Driver Blocklist (updated regularly) blocks loading of known-vulnerable drivers. Ensure HVCI (Hypervisor-Protected Code Integrity) is enabled; it significantly constrains driver loading on supported hardware. Monitor loldrivers.io for new additions to the known-vulnerable driver list.
Blockchain C2 blocking:
In environments where cryptocurrency and Web3 activity is not a business function, block outbound connections to Polygon and Ethereum RPC endpoints at the proxy or firewall level. This prevents Deadlock’s configuration retrieval from blockchain infrastructure and may impair the malware’s ability to locate its C2 after deployment.
Backup architecture:
Segmented, offline, or immutable backups (Azure Blob Storage with immutability policies, AWS S3 Object Lock) are the primary recovery mechanism for ransomware events. Ensure backups are not accessible from domain-joined hosts or through the same credentials used for production systems.