DeadLock Ransomware Disables Windows Defender, Backups and Event Logs Before Encrypting Files

Gbhackers •Mayura Kathir • August 11, 2026

DeadLock, an emerging financially motivated ransomware operation that couples conventional intrusion tradecraft with decentralized infrastructure engineered to survive disruption. First observed in July 2025, the operation uses double extortion: encrypting enterprise data while threatening publication of stolen material. The encryptor’s pre-encryption routine is built to degrade both prevention and recovery. After XOR-decoding an embedded configuration, […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

DeadLock Ransomware Utilizes Decentralized Recovery Infrastructure DeadLock ransomware has emerged as a significant threat, employing a decentralized recovery chat that integrates the Polygon blockchain and the Session messenger. This ransomware utilizes a Rust-based encryptor that disables security and backup services, clears event logs, and carefully manages its activity to prolong system usability. Victims are subjected to double extortion tactics, where their data is not only encrypted but also threatened with public release. Microsoft has identified this operation as financially motivated, highlighting its sophisticated infrastructure for victim communication and negotiation. The current status indicates ongoing threats to organizations, with no specific numbers on affected systems provided in the articles. The use of decentralized technologies marks a notable evolution in ransomware tactics, complicating recovery efforts for victims. 9 sources 67

Extracted Entities

DeadLock Ransomware Disables Windows Defender, Backups and Event Logs Before Encrypting Files

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (5)

Platforms (1)