[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$feJUJKs4SgrEZKzbH4kiO36co-DnlpJJpyyv8KJfhUUg":3},{"article":4,"iocs":41,"watch_terms":42,"solutions":43,"lesson":138},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"f088825c-cfbe-4d32-8597-599dc03ac2b8","DeadLock ransomware: Breaking down a Rust-based encryptor with decentralized recovery infrastructure","deadlock-ransomware-breaking-down-a-rust-based-encryptor-with-decentralized-reco-686d9c","Microsoft Threat Intelligence examines DeadLock ransomware, an emerging financially motivated operation distinguished by its use of decentralized infrastructure to support victim communications, negotiations, and data leak operations alongside double extortion tactics used to pressure victims. The post DeadLock ransomware: Breaking down a Rust-based encryptor with decentralized recovery infrastructure appeared first on Microsoft Security Blog.","Microsoft Threat Intelligence has analyzed DeadLock, a new ransomware operation written in Rust. This financially motivated group employs a decentralized infrastructure to manage victim communications, negotiations, and data leak sites, in addition to using double extortion tactics to increase pressure on victims.","DeadLock ransomware uses Rust and decentralized infrastructure for victim communication and double extortion.","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002F2026\u002F08\u002F10\u002Fdeadlock-ransomware-breaking-down-a-rust-based-encryptor-with-decentralized-recovery-infrastructure\u002F","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002Fwp-content\u002Fuploads\u002F2026\u002F08\u002FDeadLock-featured-image-1024x576.png","2026-08-10T15:00:00+00:00","2026-08-10T16:00:16.114031+00:00",8,[17,20],{"name":18,"type":19},"Rust","product",{"name":21,"type":22},"Microsoft","vendor","7d8b5ab8-ea0b-4ced-ae97-ec251b86993a",{"id":23,"icon":25,"name":26,"slug":27},null,"Ransomware","ransomware",[29,31,36],{"category":30},{"id":23,"icon":25,"name":26,"slug":27},{"category":32},{"id":33,"icon":25,"name":34,"slug":35},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":37},{"id":38,"icon":25,"name":39,"slug":40},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[21,18],{"controls":44,"vendors":132},[45,74,103],{"slug":46,"name":47,"problem":48,"products":49},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[50,58,66],{"vendor_slug":51,"vendor_name":52,"vendor_logo":53,"product_slug":54,"product_name":55,"url":56,"description":57},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":62,"product_name":63,"url":64,"description":65},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"slug":75,"name":76,"problem":77,"products":78},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",[79,87,95],{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"veeam","Veeam","\u002Fvendor-logos\u002Fveeam.png","veeam-data-platform","Veeam Data Platform","https:\u002F\u002Fwww.veeam.com\u002Fproducts\u002Fveeam-data-platform.html","Backup and recovery for virtual, physical, cloud and SaaS workloads, with immutable storage options.",{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"cohesity","Cohesity","\u002Fvendor-logos\u002Fcohesity.png","dataprotect","Cohesity DataProtect","https:\u002F\u002Fwww.cohesity.com\u002Fplatform\u002Fdataprotect\u002F","Backup and recovery with immutable snapshots, on premises or as a service.",{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"commvault","Commvault","\u002Fvendor-logos\u002Fcommvault.png","commvault-cloud","Commvault Cloud","https:\u002F\u002Fwww.commvault.com\u002Fplatform","Backup and recovery platform with immutable storage and recovery testing.",{"slug":104,"name":105,"problem":106,"products":107},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it.",[108,116,124],{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"truesec","Truesec","\u002Fvendor-logos\u002Ftruesec.png","truesec-incident-response","Truesec Incident Response","https:\u002F\u002Fwww.truesec.com\u002Fservice\u002Fincident-response","Incident response team with a retainer option.",{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","unit-42-retainer","Unit 42 Retainer","https:\u002F\u002Fwww.paloaltonetworks.com\u002Funit42\u002Fretainer","Incident response retainer with Unit 42, including preparation services.",{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","incident-response","CrowdStrike Incident Response","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fservices\u002Fincident-response\u002F","Incident response services, available on retainer.",[133],{"slug":134,"name":21,"logo_path":135,"roles":136},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png",[137],"reported_by",{"slug":139,"title":140,"body":141,"framework_refs":142,"framework_notes":156},"deadlock-ransomware-uses-rust-and-decentralized-infrastructure-for-double-extortion","DeadLock Ransomware Uses Rust and Decentralized Infrastructure for Double Extortion","DeadLock represents a sophisticated evolution in ransomware, leveraging Rust's performance and memory safety to build a resilient encryptor while using decentralized infrastructure to evade takedown efforts targeting command-and-control servers. The double extortion model — encrypting data AND threatening to publish stolen files — means that even organizations with solid backups face reputational and regulatory exposure if exfiltration occurs. This matters because traditional recovery strategies focused solely on restoring from backups are no longer sufficient when sensitive data has already left the environment. Organizations must treat ransomware as both a business continuity crisis and a data breach simultaneously.",[143,144,145,146,147,148,149,150,151,152,153,154,155],"CIS Control 11 – Data Recovery","CIS Control 13 – Network Monitoring and Defense","CIS Control 3 – Data Protection","CIS Control 6 – Access Control Management","NIST SP 800-61 – Computer Security Incident Handling Guide","NIST SP 800-184 – Guide for Cybersecurity Event Recovery","NIST CSF RS.RP-1 – Response Planning","NIST CSF PR.DS-1 – Data-at-Rest Protection","GDPR Article 32 – Security of Processing","GDPR Article 33 – Notification of Personal Data Breach","ITIL Service Continuity Management","MITRE ATT&CK T1486 – Data Encrypted for Impact","MITRE ATT&CK T1567 – Exfiltration Over Web Service",{}]