DeadLock Ransomware: Analysis of Rust Encryption and Decentralized Recovery

Architectural Overview and Threat Context

The emergence of DeadLock ransomware signifies a strategic shift toward high-performance, memory-safe malware development coupled with unprecedented infrastructure resilience. Developed in Rust, the DeadLock encryptor leverages the language's inherent efficiency and modularity to bypass traditional signature-based detection while providing a robust cross-platform foundation. Central to its threat profile is its departure from traditional centralized command-and-control (C2) models; instead, DeadLock utilizes a decentralized recovery architecture involving Web3 technologies and onion-routed messaging. This design philosophy is specifically engineered to ensure operational continuity, allowing the threat actors to maintain extortion workflows even in the face of infrastructure seizures or domain takedowns.

First identified in July 2025, DeadLock operates under a double-extortion model, exfiltrating sensitive data before deploying its cryptographic payload. As of mid-2026, the group's "DeadLock blog" has listed over 80 victims, with a heavy concentration (over 50%) in Europe. The threat is sector-agnostic, having compromised organizations in IT, manufacturing, mining, transportation, and hospitality across nearly every continent. Intelligence suggests that DeadLock is currently utilized by multiple affiliate groups, including those previously linked to the Lynx and INC ransomware ecosystems.

Core Design Philosophies

• Rust-Based Modernization: Utilizes Rust for speed, memory safety, and cross-platform flexibility, complicating reverse engineering.
• Operational Resilience: Employs decentralized protocols (Polygon blockchain and Session network) to eliminate single points of failure.
• Strategic Geofencing: Hardcoded environmental checks prevent execution in jurisdictions likely associated with the actors' origins or operational safe zones.
• Resource-Aware Evasion: Implements sophisticated throttling to maintain system responsiveness, avoiding the behavioral triggers often associated with high-CPU ransomware activity.
• Decentralized Extortion: Integrated AWS S3-compatible file browsing and blockchain-backed leak hosting ensure victims can access stolen data for "proof" without relying on clearweb hosting.

The following analysis deconstructs the internal mechanics of the DeadLock encryptor, beginning with its high-fidelity initialization phase.

Execution Phase I: Pre-Encryption Initialization and Environmental Checks

The initialization phase is a gatekeeping process designed to ensure the malware executes only in "approved" target environments and with the privileges required for maximum impact. By validating the environment prior to any cryptographic activity, the actors minimize detection risk in sandboxes and avoid unintended infections in specific geopolitical regions.

Configuration Parsing The malware begins by decrypting an embedded configuration blob via XOR decoding with a hardcoded 8-byte key. This blob defines the tactical parameters of the infection.

Language Geofencing DeadLock contains logic to self-delete immediately if the system's default or UI language matches any of the 17 excluded LANGIDs. This serves as a strategic marker of the threat actor's likely origins or operational boundaries:

• Russian (1049 — Russia)
• Ukrainian (1058 — Ukraine)
• Belarusian (1059 — Belarus)
• Tajik (1064 — Tajikistan)
• Persian (1065 — Iran)
• Armenian (1067 — Armenia)
• Azeri (Latin) (1068 — Azerbaijan)
• Azeri (Cyrillic) (2092 — Azerbaijan)
• Georgian (1079 — Georgia)
• Kazakh (1087 — Kazakhstan)
• Kyrgyz (1088 — Kyrgyzstan)
• Turkmen (1090 — Turkmenistan)
• Syriac (1114 — Syria)
• Romanian (2072 — Moldova)
• Uzbek (2115 — Uzbekistan)
• Arabic (8193 — Oman)
• Arabic (9217 — Yemen)

Privilege Elevation and UAC Bypass If executed without administrative rights, DeadLock attempts to elevate its context. It generates a randomly named 8-character .cmd file (e.g., ESYEKQSY.cmd) and executes it using the RunAs verb via ShellExecuteW. This forces a Windows UAC prompt. The malware is programmed with a retry threshold of 10 attempts; if the user denies the request, it re-prompts until the threshold is met, at which point it exits.

Token Privilege Escalation Upon achieving administrative status, the malware expands its access to the file system and system processes by enabling the following token privileges:

• SeDebugPrivilege & SeTakeOwnershipPrivilege: Facilitates interaction with protected processes and seizing control of system-owned files.
• SeBackupPrivilege & SeRestorePrivilege: Bypasses Access Control Lists (ACLs) to ensure all data is readable and writable.
• SeAuditPrivilege & SeSecurityPrivilege: Enables the manipulation and silencing of security logs.

With the environment validated and privileges secured, the malware transitions to neutralizing system defenses.

Execution Phase II: Defense Evasion and Forensic Countermeasures

To facilitate unhindered file access and prevent recovery, DeadLock implements an aggressive strategy of "environmental silencing." This stage removes defensive barriers and destroys forensic evidence before the cryptographic payload is deployed.

Process and Service Termination The malware enumerates all active Win32 services and running processes, terminating those that match its internal stop lists.

• Defensive Neutralization: Targets include security tools like Windows Defender (windefend, msmpeng), smartscreen, and EDR components.
• Recovery Prevention: Essential restoration services are stopped, including Volume Shadow Copy (vss), Backup Engine (wbengine), and cloud sync applications (OneDrive, Dropbox, Google Drive).
• File Unlock Logic: Database and server services (Hyper-V, Active Directory, MS Search) are stopped to release file locks on large data stores.

Event Log Clearing Strategy DeadLock employs a three-pronged forensic destruction strategy:

1. Direct Clearing: Uses the classic Event Log API to wipe primary channels (Security, System, Setup).
2. Registry-based Disabling: Enumerates all sub-keys in the WINEVT\Channels registry, setting Enabled to 0 and applying a restrictive SDDL string to lock down further access.
3. Modern API Enumeration: Uses wevtapi.dll to find and clear non-standard or third-party application log channels not found in hardcoded lists.

Forensic Note on Ransom Notes A key behavioral detail for researchers is the Second Pass Logic. While the HTML ransom note is dropped immediately, the text-based HOW_RECOVER..txt is only deployed during the second iteration of the directory processing loop. This serves to prioritize encryption speed during the initial pass and explains why the text note may be absent in short-duration sandbox tests.

Visual Branding The malware writes a custom icon to C:\ProgramData\<UID>.ico and modifies HKLM\SOFTWARE\Classes\.dlock\DefaultIcon to ensure all encrypted files display the DeadLock brand. This, coupled with emptying the Recycle Bin on all drives, signals the finality of the compromise.

Execution Phase III: Cryptographic Design and Execution Logic

DeadLock utilizes a hybrid cryptographic scheme optimized for both mathematical robustness and execution speed. Its most distinctive feature is a resource-aware "gatekeeper" thread.

Resource-Aware Throttling and Atomic Signaling Before dispatching any file for encryption, a monitoring thread polls system utilization. If Memory usage exceeds 29% or CPU Idle falls below 30%, the malware triggers a waitable timer to pause. Crucially, this uses Atomic Signaling: worker threads currently encrypting a file are not interrupted, ensuring file integrity. Only the dispatch of new files is gated.

Cryptographic Scheme The malware implements a multi-layered approach using the Networking and Cryptography Library (NaCl) constructions.

Author Tradecraft: SEC1 Format The attacker's public key uses a SEC1 compressed point format prefix (03). While standard for Bitcoin/secp256k1, this is non-standard for Curve25519. The malware validates this prefix before using the remaining 32 bytes, serving as a distinct marker of the author's custom tooling and tradecraft.

File Size-Based Strategy The configuration string (e.g., 1000,05052429880...) defines a tiered encryption policy:

File Footer Construction After encryption, the malware appends a metadata footer to the file. This footer is essential for decryption:

• Ephemeral Public Key (33 bytes): Allows the decryptor to recompute the shared secret.
• Encrypted Metadata Payload: Contains the XChaCha20 key and nonce.
• Inner dDlK Magic: A 4-byte marker inside the encrypted payload used for fast format-level sanity checks during decryption.
• FA Flag: A 2-byte indicator that dictates whether the decryptor should use sequential or intermittent read strategies.

Execution Phase IV: Decentralized Recovery and Communication Infrastructure

DeadLock eliminates single points of failure by utilizing Web3 and decentralized messaging, ensuring the extortion process remains functional despite traditional takedown efforts.

Blockchain Configuration Store The malware retrieves its infrastructure URLs from the Polygon blockchain using eth_call requests to public RPC endpoints. This requires no wallet and is resistant to censorship.

Deterministic Session Key Derivation For communication, DeadLock integrates with the Session messaging network. A victim's identity is derived deterministically to ensure the account only exists when they enter their credentials. The process is as follows:

1. Input: Victim enters credentials (Base64 UID).
2. Hashing: The input is passed through a Blake2b hash.
3. Seeding: The resulting entropy seeds the Ed25519 (signing) and Curve25519 (encryption) keypairs.
4. Network ID: The 05 prefix is appended to form the Session ID.

Wasabi and AWS S3 File Browser The RECOVERY_CHAT..html dropped by the malware is a standalone single-page application. It contains a full Amazon Web Services (AWS) S3-compatible file browser. By parsing Wasabi credentials from on-chain data, it generates AWS4-HMAC-SHA256 signed requests, allowing victims to browse exfiltrated data hosted on Wasabi storage directly from their browser without a central web server.

Infrastructure Resilience This model ensures that while a specific proxy might be reachable, the "source of truth" (the blockchain) and the communication medium (Session's onion-routed swarm) remain beyond the reach of conventional hosting takedowns.

6. Detection and Mitigation Strategies for Threat Hunters

Defending against DeadLock requires proactive hardening to break the kill chain before the resource-aware encryption begins.

Antivirus and EDR Detections

• Ransom:Win32/Deadlock.*
• Possible ransomware activity
• Suspicious wallpaper change
• File backups were deleted

Recommended Attack Surface Reduction (ASR) Rules Implement the following rules to disrupt the DeadLock lifecycle:

1. Block executable files from running unless they meet a prevalence, age, or trust criterion: Prevents the initial execution of the untrusted Rust encryptor.
2. Block process creations originating from PSExec and WMI commands: Essential for stopping the lateral movement typically used for wide-scale deployment.
3. Use advanced protection against ransomware: Enables behavioral blocking of the specific encryption patterns and file renaming logic (.dlock).
4. Block credential stealing from the Windows local security authority subsystem: Prevents the harvesting of administrative credentials needed for privilege elevation.
5. Block executable content from email client and webmail: Disrupts the common initial access vectors used by DeadLock affiliates.

Indicators of Compromise (IOCs)

DeadLock represents a formidable evolution in ransomware, combining the speed of Rust with the censorship-resistance of Web3. To defend against such threats, organizations must prioritize endpoint hardening, the implementation of ASR rules, and the rigorous protection of administrative identities.