DeadLock emerged in mid July 2025. Initial reporting described a single extortion, encryption only operation with no leak site. Subsequent analysis by ThreatScene [UNIT 31] confirmed that the group now conducts double extortion.
On affected systems the malware appends .dlock together with a short victim identifier to filenames, for example report.pdf.A1B2C3.dlock. It drops a ransom note titled HOW_RECOVER.<ID>.txt, RECOVERY_CHAT.<ID>.html and <ID>.ico. In many incidents the desktop wallpaper is also changed to reinforce the extortion message. Victims are instructed to initiate contact through the Session messenger using a supplied HTML file and Session ID, and payments are typically requested in Bitcoin or Monero. Public notices and early removal guides appeared between 16 and 18 July 2025, with later threat summaries listing DeadLock as active from July onward.
Operator Profile and Infrastructure
The ransomware performs a language check during execution and will not run on systems configured with a Cyrillic language. This behaviour is consistent with threat actors who intentionally avoid particular regions.
At the time of writing, the group does not appear to maintain dedicated command infrastructure. Instead, it compromises vulnerable WordPress sites for staging and victim interaction, a tactic that further obscures its operations and complicates active tracking by threat hunters.
Latest Ransomware Sample
The latest version of the ransomware introduces an additional victim communication artefact. Alongside the ransom note, the malware now drops a small HTML file that provides a minimal Session interface. This lowers the barrier for initial contact, particularly for victims unfamiliar with the Session messenger.
Further characteristics and tools were observed during our analysis. These cannot be disclosed at present for operational reasons. We will release additional indicators when it is safe to do so.
Observed Host Behaviour
- Files are renamed with the
.dlockextension and a short victim identifier. - A ransom note named
HOW_RECOVER.<ID>.txtis written to disk. - Many cases include a forced desktop wallpaper change.
- A compact Session HTML helper named
RECOVERY_CHAT.<ID>.htmlis deployed to steer the victim into negotiations. - Payment is sought in Bitcoin or Monero.
Timeline
- July 2025: First public reporting of DeadLock activity.
- 16 to 18 July 2025: Initial public notices and removal guides for the first observed build.
- September 2025: UNIT 31 confirms double extortion. Analysis of a newer sample also identifies a revised encryption routine and an additional artefact, a small HTML file that provides a minimal Session interface.
Tools Observed in Related Intrusions
These utilities have been identified during DeadLock incident response, used for discovery, credential access and remote administration.
| Discovery | Remote Monitoring and Management | Defence Evasion | Credential Theft | Networking | Living Off the Land Binaries and Scripts (LOLBAS) | Exfiltration |
|---|---|---|---|---|---|---|
|
SoftPerfect NetScan |
AnyDesk |
Mimikatz |
RDP |
PsExec |
||
|
PCHunter64 |
Hashes (SHA256)
We are withholding additional samples for operational reasons and will release them once disclosure no longer jeopardises ongoing work.
Update: Following recent reporting by other security firms, we’ve decided to publish all indicators of compromise (IoCs).
2b214bddaab130c274de6204af6dba5aeec7433da99aa950022fa306421a6d32
50a32403f8d323129ac25761b62e085f24e2a998e5c151084d5819271c9e7d28
e3edfeb4f36c4e79bcd2849b27001bf0f0072cb212d26ffb7a19a4469f711c6a
4f61f20fa1edfd0ce1de2ca8110c725c9d9c16a9680748c12042a3302054fc72
47ec51b5f0ede1e70bd66f3f0152f9eb536d534565dbb7fcc3a05f542dbe4428
5a1f1b6c81b6686b6810012a3413c73625736c8bda193ac1f785aac17bc8a347
eeef8e787e1aa0e59e519fe36a9376a20b942d9eb72a4ec0bcc3742752581000
b44a512e36ba155019dee5aa5b291cd32e15eb0dfa1a8c1de56c4ec84fff1694
3a6880053382cd25f16a8d76c440905beb553c6c3d998eba3f02d064751c4d04
4e7b5ce8aa9d4095a2c0184e20b4175fc91e82b4ce3199b7b3bcf3b2f89a5298
2d89fb7455ff3ebf6b965d8b1113857607f7fbda4c752ccb591dbc1dc14ba0da
YARA Rule
We have refined the detection conditions to reduce false positives and to identify the latest version of the ransomware.
rule crimeware_XX_Deadlock_ransomware
{
meta:
author = "Unit 31 <[email protected]>, ThreatScene"
type = "crimeware"
filetype = "Win32 EXE"
status = "RELEASED"
sharing = "TLP:WHITE"
source = "ThreatScene"
date = "2025-09-30"
updated = "2025-12-23"
version = "1.0"
reference = "https://threatscene.com/blog-update/deadlock-ransomware-current-assessment-and-defender-guidance/"
hash = "c9cc95ff8f2998229394dfd31c2bd6b723e826a3ca5e008d2b5be19ba419ae2c"
strings:
$s0 = "Your infrastructure DeadLocked All" ascii nocase
$s1 = "05084f9b14b02f4ffa97795a60ab1fafaf5128e3259c75459aaaeaebc80c14da78" ascii nocase
$s2 = "0x8EF7c3e531d871D3B9D559722DE77EB1dEc19dAe" ascii nocase
$s3 = "HOW_RECOVER" ascii nocase
$s4 = ".dlock" ascii nocase
$s5 = "\x40RECOVERY_CHAT\x00" ascii nocase
$s6 = "polygon" ascii nocase
$s7 = "crypt32" wide nocase
$s8 = ".ico" ascii nocase
condition:
(((uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550)) or (uint32(0) == 0x464C457F)) and filesize < 350000 and
(
(5 of ($s*))
)
}
Tactics, Techniques, and Procedures (TTPs)
The following TTPs have been observed in use by DeadLock.
| Tactic | Technique |
|---|---|
|
Initial Access |
T1078.002: Domain Accounts T1078.003: Local Accounts T1133: External Remote Services |
|
Execution |
T1047: Windows Management Instrumentation T1059.003: Windows Command Shell T1106: Native API |
|
Persistence |
T1078.002: Domain Accounts T1078.003: Local Accounts T1133: External Remote Services T1543.003: Windows Service |
|
Privilege Escalation |
T1055: Process Injection T1078.002: Domain Accounts T1078.003: Local Accounts T1543.003: Windows Service |
|
Defense Evasion |
T1006: Direct Volume Access T1027.013: Encrypted/Encoded File T1027.015: Compression T1055: Process Injection T1078.002: Domain Accounts T1078.003: Local Accounts T1497.001: System Checks T1562.001: Disable or Modify Tools T1622: Debugger Evasion |
|
Credential Access |
T1003: OS Credential Dumping T1003.001: LSASS Memory T1003.005: Cached Domain Credentials |
|
Discovery |
T1046: Network Service Discovery T1082: System Information Discovery T1083: File and Directory Discovery T1135: Network Share Discovery T1497.001: System Checks T1614: System Location Discovery T1622: Debugger Evasion |
|
Lateral Movement |
T1021.001: Remote Desktop Protocol T1021.002: SMB/Windows Admin Shares |
|
Collection |
T1039: Data from Network Shared Drive |
|
Command-and-Control |
T1219.002: Remote Desktop Software |
|
Impact |
T1486: Data Encrypted for Impact T1489: Service Stop |
Recommended Defensive Actions
- Ensure external firewalls and VPN appliances are fully patched and running supported firmware, including up-to-date threat and intrusion signatures where available.
- Monitor perimeter and VPN gateways for anomalous traffic or sudden spikes, including unexpected increases in outbound connections, abnormal Session traffic, and unusual authentication patterns.
- Hunt for new
.dlockextensions, theHOW_RECOVER.<ID>.txtnote, and theRECOVERY_CHAT.<ID>.htmlfile used for communication with the attackers. - Monitor for execution or lateral movement involving PCHunter64, SoftPerfect NetScan, PsExec, and Mimikatz on systems where such tools are not sanctioned.
- Enforce multi-factor authentication for remote access solutions, and restrict the use of remote administration tools such as AnyDesk and TeamViewer to approved administrators, or block them entirely.
- Maintain robust offline backups and verify restoration procedures.
References
- DeadLock – Ransomware Over WebChat: https://threatscene.com/blog-update/ransomware-over-webchat-deadlock/
- DeadLock v1: https://www.virustotal.com/gui/file/3cd5703d285ed2753434f14f8da933010ecfdc1e5009d0e438188aaf85501612
- DeadLock v1: https://www.virustotal.com/gui/file/c9cc95ff8f2998229394dfd31c2bd6b723e826a3ca5e008d2b5be19ba419ae2c
