DeadLock

Tactics, Techniques & Procedures (TTPs)

• Rust-based encryptor: XChaCha20 for file content, with each file key wrapped using Curve25519 ECDH and XSalsa20-Poly1305 (NaCl crypto_box); large files may be partly encrypted in intermittent 512-byte blocks (Microsoft)
• Kills security, backup and remote-access processes and disables Defender and VSS (Microsoft)
• Two Polygon smart contracts hold the chat-proxy URL and the leak-blog posts; the post-encryption HTML file queries Polygon for the proxy and relays to a Session ID (Microsoft, Group-IB via The Register)
• Session is used for victim chat; the leak blog is reachable on clearnet domains and Tor (Microsoft). Group-IB reported no leak site in January 2026, so this changed over time
• Stolen data hosted on Wasabi (S3-compatible storage)
• Cisco Talos reportedly linked the group to BYOVD and EDR-killing (not verified directly)

Known Targets

Analyst Notes

CORRECTED against Microsoft's 10 August 2026 analysis and Group-IB research. The earlier profile conflicted with these sources on first-active date (it said February 2026), the encryption scheme (it said ChaCha20-Poly1305 with RSA-4096), the victim count (it said 63; Microsoft says more than 80 on the leak site as of July 2026, and press says 96), origin (no "probable Eastern European nexus" is stated), and use of Tor versus Session. The following earlier claims were not found in any opened source and were removed: Fortinet CVE exploitation, Cobalt Strike, Sliver, BloodHound, Rclone, GPO deployment, the $50,000–$2.5M ransom range, Linux/ESXi/NAS variants, the 4–10 day staging window, and a regional victim split. Microsoft lists no ATT&CK IDs. Blockchain-stored negotiation infrastructure resists the seizure-based takedowns used against Hive and LockBit.

MITRE ATT&CK Techniques