Back Blogs.Microsoft

DeadLock ransomware: Breaking down a Rust

Blogs.Microsoft •Microsoft Threat Intelligence • August 10, 2026

Microsoft Threat Intelligence examines DeadLock ransomware, an emerging financially motivated operation distinguished by its use of decentralized infrastructure to support victim communications, negotiations, and data leak operations alongside double extortion tactics used to pressure victims.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

DeadLock Ransomware Utilizes Decentralized Recovery Infrastructure DeadLock ransomware has emerged as a significant threat, employing a decentralized recovery chat that integrates the Polygon blockchain and the Session messenger. This ransomware utilizes a Rust-based encryptor that disables security and backup services, clears event logs, and carefully manages its activity to prolong system usability. Victims are subjected to double extortion tactics, where their data is not only encrypted but also threatened with public release. Microsoft has identified this operation as financially motivated, highlighting its sophisticated infrastructure for victim communication and negotiation. The current status indicates ongoing threats to organizations, with no specific numbers on affected systems provided in the articles. The use of decentralized technologies marks a notable evolution in ransomware tactics, complicating recovery efforts for victims. 9 sources 67

Extracted Entities

DeadLock ransomware: Breaking down a Rust

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (2)