DeadLock is a financially motivated ransomware group that first emerged in mid-July 2025, initially operating an encryption-only extortion model before evolving to include double extortion. The group's primary motivation is monetary gain through the encryption of victim data and the threat of selling exfiltrated information. What sets DeadLock apart is its unique use of Polygon smart contracts to host and dynamically rotate its command-and-control infrastructure, making it challenging for defenders to block. This group does not maintain a traditional data leak site, instead leveraging dark web markets to sell stolen victim data. Furthermore, DeadLock avoids targeting systems configured with Cyrillic languages, a common behavior among threat actors seeking to evade specific regional law enforcement.

Paises afectados

Sectores atacados

URLs nuevas detectadas en IntelTracker