Latest Research on INC and The Gentlemen Ransomware: Exposed AI Infrastructure
deadlock Ransomware Group
Ransomware group profile
Description
DeadLock is a financially motivated ransomware group that emerged in mid-July 2025. The group employs double extortion tactics, demanding ransom payments in cryptocurrencies while threatening to sell stolen data on underground markets. They utilize innovative techniques, such as blockchain smart contracts, to manage their command-and-control infrastructure, enhancing their evasion capabilities.
Key insights
- •Utilizes innovative Polygon blockchain smart contracts to manage C2 proxy server addresses.
- •Employs double extortion tactics, threatening to sell exfiltrated data instead of maintaining a public leak site.
- •Initial access typically involves exploiting vulnerabilities like CVE-2024-51324 in Baidu Antivirus.
- •Ransomware is written in C++ and uses a custom stream cipher with time-based cryptographic keys.
- •Targets multiple sectors including Real Estate, Health Care, and Manufacturing.
- •Engages in defense evasion techniques such as process hollowing and PowerShell script executions.
- •Communication with victims is facilitated through Session messenger using an HTML-based interface.
Threat Level & Status Breakdown
For deadlock · Based on incidents in selected period
Status Breakdown
Recent activity
Monthly attack count for deadlock in the selected period
No intelligence data for this group.
TTPs & Attack Vectors
Tools, initial access, and MITRE ATT&CK techniques for deadlock
T1562
Impair Defenses
T1059
Command and Scripting Interpreter
T1486
Data Encrypted for Impact
T1490
Inhibit System Recovery
T1021
Remote Services
T1021.001
Remote Desktop Protocol
T1080
Taint Shared Content
T1311
T1311
T1078
Valid Accounts
T1547
Boot or Logon Autostart Execution
Victims(119)
| Company | Country | Status | Discovered | |
|---|---|---|---|---|
| Trinity Custom Homes | United States | Claimed | 4 days ago | |
| Hensel Elektrik | Germany | Claimed | 4 days ago | |
| Aeroklas Duys (Pty) Ltd | South Africa | Claimed | 16 days ago | |
| Saber1 | United States | Claimed | 18 days ago | |
| idi pharma | Spain | Data Leaked | 18 days ago | |
| Greggio Argento | Italy | Claimed | 22 days ago | |
| SHAHEEN LAW GROUP PLC - Richmond, Virginia, USA | — | Claimed | 26 days ago | |
| SHAHEEN LAW GROUP PLC | — | Claimed | 26 days ago | |
| UNION FA | Greece | Claimed | 26 days ago | |
| Far West Contractors | United States | Claimed | 26 days ago | |
| Shaheen Law Group, LLC | United States | Data Leaked | 2 months ago | |
| Furniture Bargaining Council | South Africa | Claimed | 2 months ago | |
| JP Molyneux Studio Ltd | United Kingdom | Claimed | 2 months ago | |
| UFOC | Taiwan | Claimed | 2 months ago | |
| Global Terminal Services | Turkey | Claimed | 2 months ago | |
| LT Group / Fortune Tobacco Corp | Philippines | Data Leaked | 3 months ago | |
| KAMPH | Lebanon | Claimed | 2 months ago | |
| Ahenk Laboratuvarı | Turkey | Claimed | 3 months ago | |
| DIATER | Spain | Claimed | 3 months ago | |
| Pasello Trattamenti Termici Srl | Italy | Claimed | 3 months ago |
Page 1 of 6
Affected countries(49)
Countries where this group has been reported to target or leak victims.