Microsoft details DeadLock ransomware’s decentralised extortion infrastructure

Microsoft published a DeadLock ransomware analysis on August 10, 2026. The operation combines file encryption with threats to expose stolen data. Researchers describe its use of Session messaging and blockchain-backed services to support parts of its communications infrastructure.

Resilience does not mean invulnerability

Microsoft assesses that the design may make portions of the infrastructure more resilient to disruption. However, it still depends on off-chain services. Using blockchain is therefore not evidence that the operation is impossible to interrupt.

For an affected organisation, the practical distinction is between losing access to information and losing control over its confidentiality. Those are separate problems, even when they arise during the same incident.

A company might restore an operational system while still needing to establish what information left its environment. Treating the return of working files as the end of the investigation would confuse those two questions.

This is the wider significance of double extortion: the recovery of a service and the assessment of data exposure need their own evidence and responsibilities.

Backups address one part of the problem

Earlier MS-ISAC guidance associated with the 2023 StopRansomware update emphasises offline, encrypted backups and a practised incident-response plan. This is established defensive background, rather than a new DeadLock finding.

A recoverable copy can help address the loss of access to files. It cannot undo the theft of information if that theft has already occurred. Recovery planning should therefore distinguish restoring systems from understanding exposure.

For management, that means knowing which information is sensitive and which accounts can reach it before an incident. During a disruption, a clear picture of those responsibilities provides a more useful starting point than trying to reconstruct ownership from scratch.

Small teams need a workable plan

The same MS-ISAC guidance discusses multi-factor authentication for remote access and network segmentation as overlapping defences. Their purpose is to reduce the chance that one weakness exposes the entire environment.

A small team also needs a comprehensible response process: who makes decisions, who investigates and in what order services should return. A long list of products without those responsibilities does not answer the operational question.

The DeadLock analysis illustrates why confidentiality and business continuity should be considered together. The specific findings here are attributed to Microsoft. They are not presented as evidence that any local organisation has been attacked, or as findings from an examination we performed.

Sources

• Microsoft Threat Intelligence — 10 August 2026
• MS-ISAC — background on the 2023 StopRansomware guidance