DeadLock ransomware: Breaking down a Rust-based encryptor with decentralized recovery infrastructure

DeadLock ransomware has emerged as a financially motivated operation, characterized by its utilization of decentralized infrastructure to facilitate victim communications and data leak operations. This ransomware employs a Rust-based encryptor and leverages a combination of the Session messaging network and blockchain-backed services to store and deliver resources during the extortion process. The recovery ecosystem is designed to support the ransomware's operations, allowing attackers to communicate with victims and manage the flow of stolen data. The use of decentralized infrastructure makes it challenging for authorities to track and disrupt the operation. Microsoft Threat Intelligence has been tracking DeadLock ransomware, highlighting the need for operational resilience planning to mitigate the risks associated with such attacks¹. The fact that DeadLock ransomware targets Microsoft products underscores the importance of sector-specific risk assessment and mitigation strategies, making it crucial for practitioners to prioritize robust security measures to protect against this emerging threat.