Deadlock Ransomware Recovery: What's Recoverable

Deadlock was first observed in mid-2025 and its current build, documented publicly in August 2026, is a Rust rewrite. The group claimed 101 victims on its leak site as of 31 August 2026, spanning around 40 countries and concentrated in professional services, manufacturing and technology, with a majority in the Europe and Russia region. As always, leak-site totals are the group's own claims rather than verified incidents.

File content is encrypted with XChaCha20 under a unique per-file key. That key is then wrapped to the operator's public key using Curve25519 ECDH with XSalsa20-Poly1305.

The practical consequence is that there is no shortcut from one file to the next. Each file carries its own key, and the only copy of that key is sealed so that it can be opened by the operator's private key alone. Recovering one file's key, if it were even possible, would tell you nothing about the rest.

Deadlock stores and delivers parts of its extortion infrastructure using blockchain-backed services, with command-and-control configuration held in Polygon smart contracts, alongside the Session messaging network for communication.

This matters for recovery planning in a specific way. A number of past ransomware families ended with law enforcement seizing servers and publishing the keys, which is how some victims eventually recovered without paying. Infrastructure deliberately spread across a public blockchain is harder to seize, so it would be unwise to plan around a free decryptor appearing later. Decisions should be made on what is recoverable now.

With a per-file key scheme of this design, recovery does not come from breaking the encryption. It comes from what the encryption did not reach: files or regions left unencrypted, snapshots, and backup copies the attacker did not get to. Whether that amounts to anything useful in a given incident is established by examining the affected files, not by the family name.

Do not delete encrypted files or rebuild the first compromised host. Preserve them, along with the ransom note and any attacker communications, for the assessment and for insurers. We do not claim to decrypt Deadlock.