Every ransomware crew eventually loses its website. DeadLock's operators appear to have decided not to have one.
Microsoft Threat Intelligence has published a technical breakdown of the Rust-based DeadLock encryptor, and the most consequential finding isn't in the crypto — it's in the ransom note. The file DeadLock drops on desktops and drives roots, RECOVERY_CHAT.<UID>.html, is a complete single-page web application: encrypted chat, a paginated leak blog, and an S3 file browser, all running in the victim's browser with no conventional backend behind it.
Instead of a hardcoded onion address, the page fires read-only eth_call requests at six public Polygon RPC endpoints to reach two smart contracts. One stores the URL of the operators' chat proxy; the other holds the leak blog posts.
Knock the proxy offline, and the crew simply updates the on-chain value — every note already sitting on victim machines starts pointing at the replacement. Stolen files are parked in Wasabi buckets, browsable through pre-signed URLs that the note generates on the fly. Microsoft calls the setup "a notable evolution in ransomware infrastructure design."
Victim-operator chat rides the Session network, an onion-routed messenger with no central server. The victim's Session identity is derived by hashing their chosen login and password with SHA-512 — no registration, and no recovery if they forget the combination.
DeadLock surfaced in July 2025 and had listed more than 80 organizations on its leak site by July 2026, over half of them European. Microsoft has watched multiple crews deploy it, including an affiliate of the Lynx and INC operations, against IT, mining, logistics, manufacturing, and hospitality targets across five continents.
A dispatch thread checks system load before releasing each file to a worker and stalls whenever memory use tops 29%, or CPU idle falls below 30%, keeping infected machines responsive and resource graphs unremarkable.
Large files get intermittent 512-byte-block encryption instead of a full pass. Before any of that, it disables Defender, VSS, and backup services, empties the recycle bin across all drives, and clears event logs three different ways — including flipping Enabled to 0 on every WINEVT channel. Machines set to Russian, Persian, Arabic (Oman or Yemen), or a dozen other CIS-region locales are skipped, and the binary self-deletes.
File encryption pairs Curve25519 with XChaCha20 using per-file ephemeral keys. Microsoft found no practical path to decryption without the operators' private key, so recovery comes down to backups.
Defender flags samples as Ransom:Win32/Deadlock.*. Microsoft's guidance: enable tamper protection, run EDR in block mode, tighten Controlled Folder Access, and switch on the ASR rules blocking PsExec/WMI process creation and low-prevalence executables. The encryptor's SHA-256 is a1fdf65020ce4a0f0940c793c6425baf8a0b994ec48b9baaf72788661a9d29f4.