DeadLock
DeadLock is a Windows ransomware family first reported in July 2025. Reporting from Group-IB and Cisco Talos describes it as a low-profile but technically notable extortion threat that combines custom ransomware tooling with legitimate administrative utilities. Its most distinctive feature is abuse of Polygon blockchain smart contracts to manage and rotate proxy/C2 infrastructure, an EtherHiding-like technique that makes infrastructure more resilient and harder to block or disrupt. Group-IB reported that DeadLock stores proxy server addresses in Polygon smart contracts, retrieves them via JavaScript in an HTML wrapper, and uses this mechanism to support victim communications through the decentralized messenger Session rather than a traditional public data leak site. Victims are directed to negotiate using a unique Session ID, and later ransom notes evolved from encryption-only demands to threats of data theft, exposure, or sale on underground markets.
DeadLock targets Windows systems; Group-IB noted the first known binary was written in C++ and compiled in July 2025. Cisco Talos reported that the ransomware uses a custom stream-cipher encryption algorithm with time-based cryptographic keys, while other reporting described custom cryptographic implementations rather than standard Windows crypto APIs. Talos assessed the encryption approach as sophisticated, capable of encrypting enterprise file types while using selective targeting and anti-forensics to avoid system corruption. Observed post-encryption artifacts include ransom notes in encrypted directories and wallpaper stating "Your infrastructure DeadLocked."
Observed tradecraft includes use of Bring Your Own Vulnerable Driver (BYOVD) techniques to disable defenses. Multiple sources state DeadLock exploited the vulnerable Baidu Antivirus driver BdApiUtil.sys, associated with CVE-2024-51324, to terminate arbitrary processes and disable EDR at kernel level. ESRC reported DeadLock used BdApiUtil.sys to disable Baidu EDR and then executed PowerShell scripts for privilege escalation and deletion of security systems, backup systems, and shadow copies. Talos likewise reported a previously unknown loader exploiting CVE-2024-51324 to kill EDR processes, followed by anti-recovery actions. Additional observed intrusion activity includes installation or whitelisting of AnyDesk for persistent remote access, enabling RDP for lateral movement, disabling Windows Defender real-time protection, stopping non-whitelisted services via PowerShell, and deleting shadow copies.
Group-IB reported DeadLock does not operate a conventional leak site and has remained relatively under the radar, though it has targeted a wide range of organizations. Infrastructure associated with its proxying and communications has included systems running Vesta, Shopware, cPanel, and WordPress; some appeared hijacked and others attacker-controlled. Researchers also observed multiple Polygon smart contracts tied to the operation, created or updated in August and November 2025, with funding linked in reporting to a wallet associated with the FixedFloat exchange.
High-confidence detections and references in the reporting include Cisco Talos Snort SIDs 65576, 65575, and 301358, and ClamAV detections Win.Tool.EDRKiller-10058432-0, Win.Tool.VulnBaiduDriver-10058431-1, Ps.Tool.DeleteShadowCopies-10058429-0, and Win.Ransomware.Deadlock-10058428-0.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
DeadLock 랜섬웨어는 CVE-2024-51324 취약점이 존재하는 Baidu 백신 드라이버인 BdApiUtil.sys를 공격에 활용하여 Baidu EDR을 비활성화 하고 이후 권한상승, 보안 및 백업 시스템 및 섀도우 복사본을 삭제하는 파워쉘 스크립트를 실행하기도 했습니다.
Techniques & procedures
6 distinct techniques documented for this family, organized by ATT&CK tactic.
Execution
1 technique
Execution
Command and Control
2 techniques
Command and Control
Exfiltration
1 technique
Exfiltration
IOCs tracked for this family
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
Recent activity
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A ransomware family noted in the content as using the Polygon chain for EtherHiding.
Ransomware deployed after a BYOVD-based defense-evasion step (abusing a vulnerable driver) to bypass EDR and enable encryption/extortion activity.
Ransomware that uses blockchain (Polygon smart contracts) to manage/rotate proxy infrastructure; uses an HTML wrapper for Session messenger communications; leverages AnyDesk and a BYOVD technique exploiting a Baidu Antivirus driver flaw to disable security tools.
A ransomware family discovered in July 2025 that uses Polygon smart contracts to store and rotate proxy server addresses for resilient C2, uses Session for victim negotiation, and employs a PowerShell script plus legitimate tools like AnyDesk to prepare systems for encryption and extortion.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.