DeadLock Ransomware: Blockchain-Powered Double Extortion Hits 80 European Organizations (July 2026)

DeadLock: What Happened

Between mid-2025 and July 2026, the DeadLock ransomware group executed a coordinated campaign targeting 80 organizations across Europe. The attackers successfully gained unauthorized access to sensitive corporate data, exfiltrated information, and deployed ransomware to encrypt critical files. DeadLock is notable for employing a double extortion model, threatening to leak stolen data if ransom demands are not met. The group has publicly listed its victims, intensifying pressure on affected organizations to comply with their demands.

Attack Vector & Technical Detail

DeadLock distinguishes itself by leveraging a decentralized infrastructure that complicates traditional disruption efforts. The group utilizes the Polygon blockchain to distribute decryption keys, the Session network for anonymous communications, and Wasabi cloud storage for hosting stolen data. These technologies collectively make infrastructure takedown and attribution significantly more challenging. MITRE ATT&CK tactics observed include Data from Local System (TA0005), Data from Information Repositories (TA0006), and Impact (TA0040). No specific CVEs or IOCs have been disclosed, but the use of decentralized platforms and double extortion tactics are confirmed indicators of compromise.

Confirmed Impact

The compromise affected 80 organizations, primarily across Europe, resulting in both data theft and operational disruption due to file encryption. The double extortion approach has heightened the risk of sensitive data exposure, with victim organizations facing potential regulatory scrutiny under GDPR and similar frameworks. The use of blockchain and anonymous networks has hindered law enforcement and incident response efforts, increasing the likelihood of ransom payments and prolonged recovery times for victims.

What This Means for Your Organization

DeadLock’s use of decentralized infrastructure demonstrates a significant evolution in ransomware operations, reducing the effectiveness of traditional takedown strategies. Organizations should prioritize network segmentation, robust data backup strategies, and employee awareness training to mitigate the risk of initial compromise and lateral movement. Monitoring for abnormal data exfiltration and unauthorized use of decentralized communication or storage platforms is critical. Proactive defense and incident response planning are essential given the increased resilience of ransomware operations leveraging blockchain technologies.

Detection & Response

• Immediate: Isolate affected systems and disable access to cloud storage and decentralized communication tools.
• Hunt: Search for evidence of unauthorized data transfers to Wasabi cloud storage or anomalous activity involving the Session network.
• Patch: N/A (no specific CVEs disclosed).

Source: https://www.hendryadrian.com/deadlock-ransomware-uses-blockchain-to-resist-infrastructure-takedown/