Skip to main content
Darkfield

Operator dossier

Deadlock is a ransomware operator currently active on public leak sites. Darkfield has indexed 95 public victims claimed by this operator between June 15, 2026 and July 28, 2026. Deadlock is a ransomware group first observed in June 2026 with an apparent financial motivation, having claimed responsibility for attacks against at least 10 known victims across a geographically diverse target set. Given the recency of their emergence and limited public documentation by major threat intelligence organizations such as CISA, FBI, or Mandiant at this time, a comprehensive technical profile cannot be fully established. Based on available victimology data, the group has demonstrated a targeting pattern spanning Singapore, China, Sweden, Spain, and Nigeria, suggesting an opportunistic or globally distributed operational scope rather than a regionally focused campaign. Targeted sectors include manufacturing, business services, telecommunications, and financial services, indicating a preference for industries with high operational dependencies and potential for significant disruption, which is consistent with financially motivated ransomware actors seeking maximum leverage for ransom payment. No confirmed attribution regarding country of origin, RaaS affiliation, or specific tooling has been publicly documented by authoritative sources as of this profile's preparation. Due to the group's nascent operational timeline and the limited volume of publicly verified intelligence, analysts should treat this profile as preliminary and subject to significant revision as additional technical indicators, victim disclosures, and research reporting become available. Continued monitoring is advised given the cross-sector and cross-regional targeting behavior observed in this early operational phase.

Most-targeted sectors

Most-affected countries

Recent disclosures by Deadlock

All 95 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for Deadlock →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Active ransomware operator

← All groups

Deadlock

95 victims indexed · first seen 2 months ago · last activity 2 days ago

95
Victims indexed
#80 of 374 tracked operators
1m
Active period
Jun 2026 → Jul 2026
8
Countries hit
top SG · 2

At a glance

Status
active
First seen
2 months ago
Last activity
2 days ago
Primary sector
Not Found · 4 hits

About

Deadlock is a ransomware group first observed in June 2026 with an apparent financial motivation, having claimed responsibility for attacks against at least 10 known victims across a geographically diverse target set. Given the recency of their emergence and limited public documentation by major threat intelligence organizations such as CISA, FBI, or Mandiant at this time, a comprehensive technical profile cannot be fully established. Based on available victimology data, the group has demonstrated a targeting pattern spanning Singapore, China, Sweden, Spain, and Nigeria, suggesting an opportunistic or globally distributed operational scope rather than a regionally focused campaign. Targeted sectors include manufacturing, business services, telecommunications, and financial services, indicating a preference for industries with high operational dependencies and potential for significant disruption, which is consistent with financially motivated ransomware actors seeking maximum leverage for ransom payment. No confirmed attribution regarding country of origin, RaaS affiliation, or specific tooling has been publicly documented by authoritative sources as of this profile's preparation. Due to the group's nascent operational timeline and the limited volume of publicly verified intelligence, analysts should treat this profile as preliminary and subject to significant revision as additional technical indicators, victim disclosures, and research reporting become available. Continued monitoring is advised given the cross-sector and cross-regional targeting behavior observed in this early operational phase.

References

1 link

External sources curated by the MISP threat-intel community.

Timeline

1 months
2026-06-01T00:00:00+00:00 · 10
2026-06-01T00:00:00+00:002026-06-01T00:00:00+00:00

Top countries

🇸🇬 Singapore
2
🇨🇳 China
1
🇸🇪 Sweden
1
🇪🇸 Spain
1
🇳🇬 Nigeria
1
🇮🇹 Italy
1
Iran
1
🇹🇷 Türkiye
1
Singapore dossier →China dossier →Sweden dossier →Spain dossier →

Top sectors

Manufacturing
2
Business Services
1
Telecommunication
1
Financial Services
1
Hospitality and Tourism
1
Manufacturing dossier →Business Services dossier →Telecommunication dossier →Financial Services dossier →

MITRE ATT&CK

17 techniques · 7 tactics

Tactics

Initial AccessExecutionDefense EvasionDiscoveryCollectionExfiltrationImpact

Techniques

  • T1190Exploit Public-Facing Application
  • T1133External Remote Services
  • T1059Command and Scripting Interpreter
  • T1047Windows Management Instrumentation
  • T1562.001Impair Defenses: Disable or Modify Tools
  • T1070.004Indicator Removal: File Deletion
  • T1083File and Directory Discovery
  • T1082System Information Discovery
  • T1135Network Share Discovery
  • T1057Process Discovery
  • T1005Data from Local System
  • T1039Data from Network Shared Drive
  • T1041Exfiltration Over C2 Channel
  • T1567Exfiltration Over Web Service
  • T1486Data Encrypted for Impact
  • T1490Inhibit System Recovery
  • T1489Service Stop

Recent victims

Loading…

Source

Updated 2 days ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time Deadlock posts a victim.

Add Deadlock to your watchlist — Pro pings you within 5 minutes of any new Deadlock leak-site post, Telegram callout, or affiliate-rebrand inference.