Ransomware normally announces itself by hammering a machine until it grinds to a halt. DeadLock does the opposite. Microsoft Threat Intelligence has published a teardown of the encryptor showing that it polls the computer's own CPU and memory use before it encrypts each new file, and pauses whenever the machine starts to look busy, specifically when memory use passes 29 percent or CPU load passes 70 percent.
The effect is that an infection looks like normal workload rather than a crisis. Files already being encrypted are allowed to finish, so the throttling shows up as reduced parallelism rather than visible stop-start behaviour, and the victim gets no early warning from a frozen desktop. You can read Microsoft's full analysis of the Rust-based encryptor on its security blog.
Who is being hit
DeadLock was first observed in July 2025 and is run as a financially motivated, double extortion operation, encrypting networks while threatening to publish stolen data. Microsoft has seen it deployed by more than one group, including an affiliate drawn from the Lynx and INC ransomware ecosystems. As of July 2026 the operators had named more than 80 organizations on their leak site, which they call the DeadLock blog, and more than half of those claimed victims are in Europe.
Microsoft has identified DeadLock activity in information technology, mining, transport and logistics, manufacturing, hospitality and consumer goods, across Europe, Asia, North America, South America and Africa. IntelFusions covered the crew's July batch of claimed victims, and our DeadLock profile tracks its leak site postings.
The encryptor also checks the system and user interface language before doing anything, and quietly deletes itself if it finds one of 17 language settings tied to Russia, Ukraine, Belarus, Central Asia, the Caucasus, Moldova, Iran, Syria, Oman or Yemen. That kind of geofencing is a long-standing tell among crews operating from those regions.
How the attack works
If it is not already running with administrator rights, the encryptor drops a randomly named .cmd file and relaunches itself through the Windows consent dialog, retrying up to 10 times if the user says no. With administrator rights it enables a set of powerful Windows privileges, including debug, backup, restore and take-ownership rights, so that protected files and system processes stop being obstacles.
What follows is a systematic dismantling of recovery and visibility. It empties the recycle bin on every drive. It disables and stops Windows Defender, the Volume Shadow Copy and backup services, Hyper-V services and Active Directory services, and kills running security tools, backup and cloud sync clients such as OneDrive and Dropbox, and remote access tools including AnyDesk and RustDesk. Then it goes after the evidence: it clears the classic Windows event logs, walks the registry to set every event channel to disabled so nothing new is recorded, locks each channel's permissions down, and uses a second modern enumeration method to catch custom channels the hardcoded list would miss.
Encrypted files are renamed with a .dlock extension and given a custom icon the malware registers for the purpose. For large files it encrypts only part of the content, dropping from full encryption to 50 percent above roughly 50 MB and to 10 percent above roughly 500 MB, scattering encrypted 512-byte blocks through the file at intervals. That leaves databases, backups and virtual machine images unusable in a fraction of the time full encryption would take.
On the cryptography, Microsoft's verdict is blunt. DeadLock pairs Curve25519 key exchange with the XChaCha20 stream cipher, generating a fresh key for every file, and Microsoft assesses the construction is sound with no practical path to decryption without the operators' private key. The extortion infrastructure is unusually resilient too, combining the Session messenger with blockchain-backed services to host the leak and negotiation material, which Microsoft assesses likely helps the operation survive takedown attempts.
What you should do
Microsoft's report carries detections, mitigation guidance and indicators. Defenders should watch for services being disabled en masse, and treat event log channels being switched off in the registry as a high-confidence sign of an intrusion in progress rather than a configuration accident. One published sample hash is a1fdf65020ce4a0f0940c793c6425baf8a0b994ec48b9baaf72788661a9d29f4.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.