DeadLock uses decentralised services around its extortion operation

Microsoft analysed DeadLock on 10 August, describing ransomware paired with data-theft threats and a recovery ecosystem using Session messaging and blockchain-backed services. Researchers assessed that the architecture could help parts of the operation withstand disruption.

The report says Microsoft observed deployment by multiple groups. It also records more than 80 organisations listed on the operation’s leak site by July, which is a count of the attackers’ public claims rather than independently verified victims. The encryptor and the surrounding negotiation, communication and leak systems serve different roles. Understanding those dependencies is part of assessing how the operation persists after one domain or service is removed.