DeadLock ransomware’s most operationally significant feature is not its encryptor — it is where the encryptor gets its instructions. The full C2 configuration, including addresses, cryptographic keys, and operational parameters, is stored inside Polygon blockchain transactions. The encryptor reads this configuration at runtime by querying the public ledger. This means the C2 cannot be disrupted by any of the standard law enforcement tools: there is no domain to seize, no hosting provider to serve with a court order, no IP to block at the BGP level, and no company to compel to cooperate.

The Session messaging application serves as the victim-communication layer for ransom negotiations. Session is a decentralized, end-to-end encrypted messenger with no central server that can be served with a disclosure order. It does not require a phone number or email address to register, which means victim communications generate no identifying metadata for investigators. Together, Polygon and Session give DeadLock ransomware an infrastructure posture that is functionally immune to the server-seizure and administrator-arrest playbook that dismantled previous major ransomware operations.

The first thing DeadLock ransomware does on an elevated system is load a BYOVD loader that exploits CVE-2024-51324, a privilege management flaw in the legitimate Baidu Antivirus driver BdApiUtil.sys. The operator deploys the driver under a disguised name — DriverGay.sys in observed samples — and uses it to issue ZwTerminateProcess() calls at the kernel level, instantly killing any targeted security service. Because the driver operates in kernel mode with the highest system privileges, it bypasses the process-protection features that modern EDR agents use to defend themselves from user-mode termination attempts.

Once the EDR is dead, a PowerShell script completes the Defender removal. The script uses SystemSettingsAdminFlows.exe — a legitimate Windows binary — to modify Defender’s registry settings, turning off real-time protection, cloud submission, and sample consent without triggering the standard tamper protection that blocks direct registry writes to Defender’s configuration paths. The combination of BYOVD for the EDR and SystemSettingsAdminFlows.exe for Defender leaves the target environment with no active threat detection before the ransomware’s destructive phase begins.

After killing endpoint detection, DeadLock ransomware turns to recovery infrastructure. The service stop list in the malware’s configuration targets windefend (Windows Defender), vss, swprv, and wbengine (Volume Shadow Copy and Backup services), mssearch, all Hyper-V services (vmcompute, vmms), Active Directory services (adws, ntds, kdc), and every major backup and database platform it can find. Named targets include Veeam Backup, Acronis, Veritas, and SQL Server.

For each service in the stop list, DeadLock ransomware sets the start type to DISABLED before issuing the stop command — meaning the service cannot be restarted without manual administrator intervention even after a reboot. Volume Shadow Copies are then deleted entirely, removing Windows’s built-in point-in-time recovery capability. Cloud storage sync clients — OneDrive, Dropbox, Google Drive — are also terminated to prevent any auto-sync from preserving copies of files before encryption. The cumulative effect is that by the time encryption begins, every automated recovery mechanism the target organization had deployed is offline and disabled.

DeadLock ransomware’s event log destruction is more thorough than any previously documented ransomware in this category. It clears the four primary Windows log channels — Security, System, Application, and PowerShell — through the Event Log API. It then walks the WINEVT Channels registry tree and clears every additional registered channel it finds, covering third-party security tool logs, custom application telemetry, and any other event source that was writing to the Windows event infrastructure. Finally, it replaces the ChannelAccess permissions on each channel with a restrictive SDDL descriptor, preventing re-enabling without explicit administrator action.

Microsoft’s analysis notes that DeadLock ransomware also uses wevtapi.dll to enumerate and clear registered channels beyond the hard-coded set. This means even channels that did not exist when the malware was compiled — new telemetry sources added after the initial infection — get wiped on detonation. The Microsoft Threat Intelligence team’s guidance is explicit: treat absent or suddenly disabled event channels as a material DeadLock hunting signal, not as evidence that nothing happened. The silence is the indicator.

Once the environment has been stripped, DeadLock ransomware deploys its Rust-based encryptor. The encryptor uses a custom stream cipher algorithm with time-based cryptographic seeds — the encryption keys are derived in part from the system clock at the time of encryption. This design serves two purposes. First, it complicates decryption attempts that depend on pattern analysis across multiple encrypted files, since each file’s key material varies with timing. Second, it makes brute-force decryption without operator cooperation extremely difficult, since the key space is bounded by time but not in a way that is tractable without knowing the precise seeding parameters.

Encrypted files receive the .dlock extension and a unique hexadecimal identifier that the operator uses to track victims. The encryptor is designed to selectively target files — it skips extensions and file names that appear in a hard-coded exclusion list to avoid rendering the operating system unbootable, since a victim who cannot operate their computer cannot pay the ransom. DeadLock ransomware prioritizes operational continuity for the victim organization precisely because the attack’s goal is payment, not destruction.

The most consequential thing about DeadLock ransomware is not its capability against individual victims — it is its resilience against the enforcement actions that have defined ransomware disruption strategy for the past three years. Operation Cronos took down LockBit by compromising their infrastructure. The FBI and European partners disrupted Hive by gaining access to their backend. ALPHV collapsed partly due to law enforcement pressure on their operations. Every one of those successes depended on identifying and seizing servers or administrator accounts that were reachable through conventional legal process.

DeadLock’s Polygon-based configuration and Session-based communications eliminate both of those attack surfaces for law enforcement. The configuration cannot be seized because it exists on a public decentralized ledger. The communications cannot be subpoenaed because Session has no central server and retains no user metadata. This does not make DeadLock ransomware operators invulnerable — they can still be identified through affiliate operations, victim-network artifacts, and cryptocurrency tracing — but it removes the infrastructure disruption option that has been the primary law enforcement tool.

DeadLock ransomware first appeared in July 2025. By July 2026, its blog had named more than 80 alleged victims across IT, mining, transport, logistics, manufacturing, hospitality, consumer goods, and healthcare organizations on six continents. More than half the named victims are in Europe. The sector breadth is unusual for a group at this operational age — most ransomware groups spend their first year targeting opportunistic victims in a single sector before expanding. DeadLock’s cross-sector, cross-continent footprint in its first year suggests either a sophisticated affiliate recruitment program or a core operator team with broad initial-access capabilities.

Microsoft’s analysis identified multiple threat actors deploying DeadLock ransomware, including affiliates of the established Lynx and INC ransomware groups. That affiliate overlap is significant: it means experienced ransomware operators who already have established initial-access playbooks are adopting DeadLock as their encryptor of choice, suggesting that word has spread through the ransomware-as-a-service ecosystem that DeadLock’s infrastructure resilience and anti-forensics capabilities are operationally superior to alternatives.