deadlock Ransomware Group

Key insights

• •Utilizes innovative Polygon blockchain smart contracts to manage C2 proxy server addresses.
• •Employs double extortion tactics, threatening to sell exfiltrated data instead of maintaining a public leak site.
• •Initial access typically involves exploiting vulnerabilities like CVE-2024-51324 in Baidu Antivirus.
• •Ransomware is written in C++ and uses a custom stream cipher with time-based cryptographic keys.
• •Targets multiple sectors including Real Estate, Health Care, and Manufacturing.
• •Engages in defense evasion techniques such as process hollowing and PowerShell script executions.
• •Communication with victims is facilitated through Session messenger using an HTML-based interface.