DeadLock went silent for 11 months, then hit 80 victims in one

Peer Review

Gartner brand name text logo in white with registered trademark symbol.
5-star rating
4.8

Proven Trust

Dark blue circle with two overlapping checkmarks, one green and one light blue.
ISO 27001 text with a globe outline symbol on a black background.
2025 winner badge for Cyber Security Excellence Awards with gold and black design.

DeadLock hosts its command and control on the Polygon blockchain, making takedown far harder. See how it operates.

Get Guide

You can't seize a server that lives on a blockchain

Success here means stopping the BYOVD kernel-level EDR kill before encryption starts, not trying to take down infrastructure that has no single point of failure.

  • Deploys via affiliates also tied to the Lynx and INC ransomware ecosystems
  • Uses a BYOVD loader to kill EDR at the kernel level before encrypting
  • Hosts command and control on the Polygon blockchain, making takedown far harder than seizing a server
Get Your Guide

Who This Guide is For

CISO / Head of Security

DeadLock's June 2026 surge briefly made it the world's second most active group. This guide covers the detection priorities that matter when takedown infrastructure isn't an option.

SOC Manager / Security Operations Lead

Kernel-level EDR kills happen fast, before encryption is even visible. This guide explains what to watch for at the BYOVD stage.

IT Director / Head of IT

Shared tooling with Lynx and INC affiliates means overlapping indicators. This guide sets out what to patch and monitor across all three.