DeadLock Ransomware Disables Windows Defender, Backups and Event Logs Before Encrypting Files

DeadLock, an emerging financially motivated ransomware operation that couples conventional intrusion tradecraft with decentralized infrastructure engineered to survive disruption.

First observed in July 2025, the operation uses double extortion: encrypting enterprise data while threatening publication of stolen material.

The encryptor’s pre-encryption routine is built to degrade both prevention and recovery.

After XOR-decoding an embedded configuration, DeadLock checks default and UI language identifiers and deletes itself when it detects Russian, Ukrainian, Belarusian, several CIS languages, Iran, Syria, Oman or Yemen.

This geofencing is not attribution, but is consistent with a regional avoidance pattern.

On systems without elevation, the Rust-based malware generates a randomly named CMD file and repeatedly invokes ShellExecuteW with RunAs, attempting to force a UAC approval.

Elevated execution unlocks SeDebugPrivilege, SeBackupPrivilege, SeRestorePrivilege, SeTakeOwnershipPrivilege and related privileges.

DeadLock then empties Recycle Bins, registers a custom icon for its .dlock extension, and stops processes and services likely to impede encryption.

Windows Defender’s windefend service, VSS, Windows Backup, Hyper-V components and Active Directory services are among the listed targets.

The process kill list includes MsMpEng, SmartScreen, cloud-sync clients, backup software, remote-access utilities, PowerShell, Task Manager and Explorer.

The intent is dual-purpose: release files held open by applications and blind defenders while removing local recovery paths.

Its log destruction is particularly aggressive. The ransomware clears standard Windows channels, including Security, System, Application and PowerShell, through the Event Log API.

It also walks the WINEVT Channels registry tree, sets Enabled to zero, and replaces ChannelAccess permissions with a restrictive SDDL descriptor.

Microsoft Threat Intelligence Researchers said that, By July 2026, its DeadLock blog had named more than 80 alleged victims, over half in Europe, spanning IT, mining, logistics, manufacturing, hospitality and consumer-goods organizations worldwide.

DeadLock Ransomware attack

Finally, it uses wevtapi.dll to enumerate and clear registered channels beyond the hard-coded set, covering custom and third-party telemetry.

Incident responders should therefore treat absent or suddenly disabled event channels as a material DeadLock hunting signal, rather than evidence that no activity occurred.

For encryption, DeadLock pairs XChaCha20 with per-file Curve25519 ECDH and NaCl crypto_box metadata wrapping.

Each file receives fresh symmetric key material and an ephemeral keypair, then is renamed with a victim-specific .dlock suffix.

Microsoft assesses the cryptographic construction as sound, leaving no practical recovery route without the actor’s private key.

Large files are only partially encrypted in distributed 512-byte blocks at configured thresholds, accelerating impact against databases, VM images and backups.

A dispatch gate pauses new work if memory use exceeds 29% or CPU load exceeds 70%, reducing visible system contention and weakening behavioural detection.

The post-encryption workflow differentiates DeadLock ransomware. A local RECOVERY_CHAT.<UID>.html application retrieves a proxy address and leak-blog content from Polygon smart contracts, then relays victim communications through the onion-routed Session network.

The interface can surface files hosted through Wasabi’s S3-compatible service. Decentralization does not eliminate dependencies on public RPC endpoints, a live proxy and object storage, but it makes domain seizures and conventional hosting takedowns less decisive.

Organizations should prioritize tamper protection, EDR in block mode, Controlled Folder Access and tested, isolated backups. Hunt for mass service disablement, Event Log configuration changes, .dlock creation, wallpaper changes and the HTML recovery artifact.

Microsoft has linked observed deployments to multiple groups, including an affiliate in the Lynx and INC ransomware ecosystems an indication that DeadLock may spread through an affiliate-driven access model rather than one monolithic crew.

IOCs

Indicator	Type	Description
a1fdf65020ce4a0f0940c793c6425baf8a0b994ec48b9baaf72788661a9d29f4	SHA-256	DeadLock ransomware encryptor
deadlock.liveblog365[.]com	URL	Leak site domain
dlock.liveblog365[.]com	URL	Leak site domain
deadblogdbdu5wprek7wa2o4ce7rnt6u6ntqeud3hzjjcveosgpsqqqd[.]onion	URL	Leak site domain

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Why use the 2026 Agentic SOC Buyer’s Guide? 8 Best Platforms Compared – Download the 2026 Buyer’s Guide