DeadLock Ransomware: Inside Its Rust Encryptor and Recovery Network

Summary

DeadLock is an emerging Rust-based ransomware operation that relies on decentralized infrastructure for victim communication and data leak activity. The group follows a double-extortion model, encrypting systems while threatening to publish stolen information through a dedicated leak blog. DeadLock stands out for its use of the Session messaging network and Polygon blockchain to improve operational resilience.

Investigation

Microsoft Threat Intelligence analyzed the DeadLock encryptor, examining its execution flow, defense evasion techniques, and distinctive encryption architecture. The investigation uncovered a resource-aware throttling mechanism and a decentralized recovery chat system built around blockchain technology and onion-routed messaging. Researchers also identified geofencing functionality and specific lists of services and processes targeted for termination.

Mitigation

Recommended mitigations include enabling cloud-delivered protection and EDR in block mode through Microsoft Defender. Organizations should deploy Controlled Folder Access (CFA) and Attack Surface Reduction (ASR) rules to restrict unauthorized file modifications and malicious process execution. Strengthening credential hygiene and enabling tamper protection are also essential for reducing ransomware exposure.

Response

If DeadLock activity is detected, organizations should use automated attack disruption and investigation and remediation capabilities within Microsoft Defender XDR. Security teams should investigate alerts such as Suspicious wallpaper change or File backups were deleted and promptly isolate affected endpoints. Rapid containment is critical to limiting further lateral movement and data exfiltration.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: The adversary seeks to deploy ransomware. To ensure maximum impact and avoid detection, they first attempt to escalate privileges by mimicking the behavior of tools that require SeDebugPrivilege. They use RunAs or command-line patterns that the rule targets. The simulation will execute a command attempting to invoke a process using RunAs logic while ensuring the system language is set to a non-excluded locale (e.g., English) to ensure the not selection_language condition does not suppress the alert.

• Regression Test Script:

  # Simulation script to trigger DeadLock Ransomware Detection
  # This script mimics the attempt to use RunAs via command line 
  # while ensuring the language exclusion doesn't catch it.
  
  Write-Host "[+] Starting DeadLock Ransomware Simulation..." -ForegroundColor Cyan
  
  # 1. Mimic the 'selection_command' part of the rule
  # We use 'RunAs' in a way that generates a process creation event
  $TargetProcess = "cmd.exe"
  $CommandToRun = "RunAs /user:Administrator cmd.exe"
  
  Write-Host "[+] Executing command to trigger detection: $CommandToRun" -ForegroundColor Yellow
  
  # We use Start-Process to simulate the creation of a process containing the string
  Start-Process "cmd.exe" -ArgumentList "/c $CommandToRun" -WindowStyle Hidden
  
  Write-Host "[+] Simulation command sent. Check SIEM for Alert." -ForegroundColor Green

• Cleanup Commands:

  # Cleanup any lingering cmd processes spawned by the simulation
  Stop-Process -Name "cmd" -Force -ErrorAction SilentlyContinue
  Write-Host "[+] Cleanup complete." -ForegroundColor Cyan