deadlock
ransomware group · aka DeadLock · unknown · active since 2024-09 (first publicly documented; some vendor timelines place earliest activity in September-October 2024)
Victims · 7d
0flat
Victims · 30d
6active targets
Victims · 90d
28
All-time (tracked)
103since 2026-06-15
Last post
09-01 21:35UTC
Estimated earnings
—public reporting
Profile · glm-5.3-flash · updated
Deadlock is an active ransomware group first documented by vendors in late 2024, known for a Go-written encryptor and double-extortion tactics. Early campaigns spread through pirated-software and torrent downloads bundled with an installer that displayed a fake 'I'm not a robot' CAPTCHA before executing the malware, and a later variant with a new loader and updated encryptor was described by Trend Micro in 2025. The group exfiltrates victim data before encryption and posts non-payers to its Tor leak site, with ransom negotiations historically handled via Tox messenger and, in later variants, email. Public reporting does not attribute a country of origin, and no earnings figures have been published. This dashboard's tracking shows sustained activity, with 103 leak-site posts in the past 90 days and the most recent post on 2026-09-01.
Tactics & tooling
- Delivered via pirated software and torrent downloads bundled with an installer (2024-2025 campaigns)
- Fake 'I'm not a robot' CAPTCHA (legit.exe) used to gain user trust and execution (Progress/Telerik research, 2024)
- Go-based encryptor; later variant adds a new loader and updated encryptor (Trend Micro, 2025)
- Double extortion: data exfiltration before encryption, leak-site posting if ransom unpaid
- Ransom-note contact via Tox messenger; later variants direct victims to contact email addresses
- High-volume, size-agnostic targeting across multiple countries rather than sector- or region-specific campaigns
Targeted sectors
legalprofessional servicesmanufacturingconsumer goods (incl. tobacco)healthcare/medical labslogistics/terminal services
Notable public victims
JP Molyneux Studio (luxury yacht design studio; leak-site listing), LT Group / Fortune Tobacco Corp (Philippine conglomerate; leak-site listing), Global Terminal Services (leak-site listing), SHAHEEN LAW GROUP PLC - Richmond, Virginia, USA (leak-site listing)
Estimated earnings
No public figure.
Leak-site victims103 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| The Morton Grove Park District | · Jun 15, 2026 | The Morton Grove Park District (MGPD) is a separate municipal agency established in 1951, governed by five elected commissioners and subject to Illinois state laws. https://mortongroveparks.com/ Their motto is: Everyone who lives in, works in, or visits Morton Grove has constitutional rights, no matter their citizenship or immigration status. The Village is committed to making sure every person feels safe, supported, and respected. More than 50 GB of data containing personal and sensitive information belonging to both internal employees and the organization's clients and suppliers. Documents on financial plans and internal policies are protected by a non-disclosure policy. (Including racist and sexist insights) We invite all journalists, lawyers, and law enforcement agencies to review this information. |
| Weinberg ''93 Építő Kft. | · Jun 15, 2026 | Weinberg ''93 Építő Kft., a prominent Hungarian construction and steel fabrication company. Tax number 11069430205 Registration number 05 09 002902 Full name Weinberg ''93 Építő Kft. https://weinberg.hu/ Overview: Founded in 1993 and headquartered in Sбrospatak, it is a 100% privately owned Hungarian company. Core Services: The firm specializes in general contracting and the manufacture of complex steel structures. Major Projects: They have handled significant industrial developments, including: - Volvo Trucks Hungary: Completed a 5,500 mІ advanced truck center in Ecser. - Continental Automotive: Construction of electronics manufacturing plants. - East Gate PRO Business Park: Developed BREEAM-certified sustainable warehouses. - Becton Dickinson: Expansion of a major syringe factory in Hungary. Recognitions: The company has received numerous awards, such as the Lechner Цdцn Award (2024) and the Steel Structure Award (2022). Over 650 gigabytes of sensitive internal data were stolen from this company: all commercial information about contractors, information about specialized construction technologies and metal structure production, internal financial transactions, and operations demonstrating corruption in construction projects. We invite all journalists, lawyers, and law enforcement agencies to review this information. |
| Catcorp | · Jun 15, 2026 | Business direction: Mew mew |
In the newsAll →
Victim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .