DEADLOCK Ransomware Gang: 3 New Victims Posted to Dark Web Leak Site — Cross-Continental Campaign Hits UK, Taiwan, and Turkey

Classification: TLP:CLEAR — Enterprise Defensive Intelligence Source: ransomware.live aggregation of DEADLOCK .onion leak site Report Date: 2026-08-21 Analyst: Security Arsenal — From The Dark Side Threat Intelligence Hub

Executive Summary

Security Arsenal's dark web collection infrastructure has confirmed 3 new victim postings on the DEADLOCK ransomware gang's .onion leak site within a 48-hour window (2026-08-19 through 2026-08-20). The victims span three continents — the United Kingdom, Taiwan, and Turkey — with one confirmed hit against a transportation/logistics operator (Global Terminal Services, TR), a sector that ransomware crews increasingly target due to extreme operational sensitivity and pressure to pay quickly.

Correlation with CISA's Known Exploited Vulnerabilities (KEV) catalog shows active ransomware use of an improper authentication flaw in Check Point Security Gateway (CVE-2026-50751) and the ConnectWise ScreenConnect path traversal (CVE-2024-1708) — both consistent with DEADLOCK's historical tradecraft of edge-device compromise and RMM tooling abuse. Organizations running perimeter VPN appliances, legacy Exchange, or unattended remote access tooling should treat this as an active exposure window.

Threat Actor Profile — DEADLOCK

Analyst Note: DEADLOCK's leak site cadence has historically come in bursts — quiet periods of 2–3 weeks followed by 3–6 postings within 72 hours. The current cluster matches this pattern and suggests at least one concurrent intrusion may not yet be public.

Current Campaign Analysis

Recent Victims (Leaked 2026-08-19 → 2026-08-20)

Sector Targeting

The campaign's standout signal is the hit on Global Terminal Services, a transportation/maritime terminal operator in Turkey. Transportation and logistics victims carry outsized extortion leverage: cargo delays, port congestion, and perishable-goods spoilage create immediate financial bleeding that pressures rapid payment. The remaining two victims — a UK-based design studio and a Taiwanese organization pending classification — are consistent with DEADLOCK's opportunistic mid-market sweep rather than a vertically focused campaign.

Geographic Concentration

No geographic concentration exists: GB, TW, and TR span Western Europe, East Asia, and the Middle East. This dispersion is a hallmark of vulnerability-scan-driven targeting (mass exploitation of exposed edge devices) rather than spear-phishing against a defined victim list. Any organization with an internet-facing Check Point gateway, unpatched ScreenConnect instance, or exposed RDP is in-scope regardless of region.

Victim Profile

• JP Molyneux Studio: Mid-size professional/design services firm, likely £2M–£20M annual revenue — typical of DEADLOCK's mid-market bread-and-butter where ransom demands in the $400K–$800K range are realistic.
• Global Terminal Services: Transportation infrastructure operator, estimated $25M–$150M revenue with high-value operational data (cargo manifests, customs documentation, terminal operating system exports) — prime double-extortion leverage.
• UFOC (TW): Classification pending; the "Not Found" sector tag on the leak site often indicates either a smaller organization or deliberate obfuscation while negotiations are ongoing.

Posting Frequency & Escalation

Two postings on 2026-08-19 followed by one on 2026-08-20 indicates compressed disclosure cadence — either parallel intrusions reaching extortion deadlines simultaneously, or a deliberate batch-release strategy to maximize pressure and media visibility. Watch for a second wave within 7–10 days.

CVE Correlation — Probable Initial Access Vectors

The following KEV entries, all flagged with confirmed ransomware use, map directly onto DEADLOCK's documented tradecraft:

• CVE-2026-50751 — Check Point Security Gateway Improper Authentication (IKEv1): Added to KEV 2026-06-08. Unauthenticated bypass of IKEv1 key exchange on perimeter gateways. This is the highest-probability initial access vector for the current campaign given DEADLOCK's edge-device focus and the cross-continental victim spread characteristic of mass scanning.
• CVE-2024-1708 — ConnectWise ScreenConnect Path Traversal: RCE on unpatched RMM infrastructure. DEADLOCK affiliates have historically abused RMM tooling both for access and for legitimate-looking lateral movement/encryption deployment.
• CVE-2025-60710 — Microsoft Windows Link Following: Local privilege escalation post-compromise; likely used in the escalation phase to obtain SYSTEM before shadow copy deletion.
• CVE-2023-21529 — Microsoft Exchange Deserialization: Authenticated RCE — relevant for organizations where mailbox compromise preceded lateral movement.
• CVE-2026-48027 — Nx Console Embedded Malicious Code: Supply-chain vector targeting developer workstations; lower probability for this campaign but relevant for the Taiwanese victim pending attribution.

Detection Engineering

The following detections target DEADLOCK's observed playbook: VPN/edge exploitation follow-on activity, RMM abuse, WMI/PsExec lateral movement, shadow copy destruction, and pre-encryption staging.

---
title: DEADLOCK Ransomware - Volume Shadow Copy Deletion via vssadmin or WMIC
id: 8f3a1d2e-7c41-4b9a-a2f1-dead1001lock
status: production
description: Detects deletion or resizing of Volume Shadow Copies, a near-universal pre-encryption step observed in DEADLOCK intrusions to prevent rapid recovery.
author: Security Arsenal Threat Intelligence
date: 2026/08/21
references:
    - https://securityarsenal.com/darkside
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith:
            - '\vssadmin.exe'
            - '\wmic.exe'
            - '\bcdedit.exe'
    selection_cmd:
        CommandLine|contains:
            - 'delete shadows'
            - 'shadowcopy delete'
            - 'resize shadowstorage'
            - 'recoveryenabled no'
    condition: selection_img and selection_cmd
falsepositives:
    - Legitimate backup maintenance scripts (rare; validate against change windows)
level: critical
tags:
    - attack.impact
    - attack.t1490
---
title: DEADLOCK Ransomware - Lateral Movement via PsExec or Remote Service Creation
id: 8f3a1d2e-7c41-4b9a-a2f1-dead1002lock
status: production
description: Detects PsExec-style remote execution and suspicious service creation used by DEADLOCK operators to deploy encryptors and staging tools across the estate.
author: Security Arsenal Threat Intelligence
date: 2026/08/21
logsource:
    product: windows
    service: system
detection:
    selection_eventid:
        EventID: 7045
    selection_service:
        ServiceName|contains:
            - 'PSEXESVC'
            - 'paexec'
            - 'csexec'
        ImagePath|contains:
            - '\Temp\'
            - '\AppData\'
            - 'ADMIN$'
            - 'ScreenConnect'
    condition: selection_eventid and selection_service
falsepositives:
    - Legitimate administration via PsExec or sanctioned RMM tooling; baseline approved service names
level: high
tags:
    - attack.lateral-movement
    - attack.t1021.002
    - attack.t1569.002
---
title: DEADLOCK Ransomware - Suspicious Outbound from Check Point Gateway or Edge VPN Follow-On Process
id: 8f3a1d2e-7c41-4b9a-a2f1-dead1003lock
status: experimental
description: Detects post-exploitation process execution patterns consistent with CVE-2026-50751 (Check Point IKEv1 auth bypass) follow-on activity and exfiltration staging via common archive/cloud tooling.
author: Security Arsenal Threat Intelligence
date: 2026/08/21
logsource:
    category: process_creation
    product: windows
detection:
    selection_archive:
        Image|endswith:
            - '\rar.exe'
            - '\7z.exe'
            - '\winzip.exe'
    selection_exfil:
        Image|endswith:
            - '\rclone.exe'
            - '\megasync.exe'
            - '\filezilla.exe'
    selection_flags:
        CommandLine|contains:
            - 'a -hp'
            - '-p'
            - 'sync'
            - '--config'
    condition: (selection_archive or selection_exfil) and selection_flags
falsepositives:
    - IT-managed backup/archival jobs; whitelist approved rclone configurations
level: high
tags:
    - attack.collection
    - attack.t1560.001
    - attack.exfiltration
    - attack.t1567.002

// Security Arsenal — DEADLOCK Pre-Ransomware Staging Hunt (Microsoft Sentinel)
// Hunts for the lateral-movement-to-staging chain: suspicious service installs,
// shadow copy tampering, and archive/exfil tooling — within a 7-day window.
// Tune the exclusion lists to your sanctioned admin/RMM tooling before production use.

let lookback = 7d;
let sanctioned_rmm = dynamic(["ScreenConnect.ClientService", "TeamViewer", "AnyDesk"]);

let ShadowCopyTamper = SecurityEvent
| where TimeGenerated > ago(lookback)
| where EventID == 4688
| where Process has_any ("vssadmin", "wmic", "bcdedit")
| where CommandLine has_any ("delete shadows", "shadowcopy delete", "recoveryenabled no", "resize shadowstorage")
| project ShadowTime=TimeGenerated, ShadowHost=Computer, ShadowAccount=Account, ShadowCmd=CommandLine;

let SuspiciousServices = Event
| where TimeGenerated > ago(lookback)
| where EventID == 7045
| where ServiceName !in~ (sanctioned_rmm)
| where ServiceName has_any ("PSEXESVC", "paexec", "csexec")
   or ServiceFileName has_any ("\\Temp\\", "\\AppData\\", "ADMIN$")
| project SvcTime=TimeGenerated, SvcHost=Computer, SvcName=ServiceName, SvcPath=ServiceFileName;

let ExfilStaging = SecurityEvent
| where TimeGenerated > ago(lookback)
| where EventID == 4688
| where Process has_any ("rclone", "7z.exe", "rar.exe", "megasync")
| project ExfilTime=TimeGenerated, ExfilHost=Computer, ExfilAccount=Account, ExfilCmd=CommandLine;

// Correlate: any host showing 2+ of the three behaviors within the window
ShadowCopyTamper
| join kind=fullouter SuspiciousServices on $left.ShadowHost == $right.SvcHost
| join kind=fullouter ExfilStaging on $left.ShadowHost == $right.ExfilHost
| extend Host = coalesce(ShadowHost, SvcHost, ExfilHost)
| summarize SignalCount = countif(isnotempty(ShadowTime)) + countif(isnotempty(SvcTime)) + countif(isnotempty(ExfilTime)),
            FirstSeen = min_of(coalesce(ShadowTime, datetime(9999-01-01)), coalesce(SvcTime, datetime(9999-01-01)), coalesce(ExfilTime, datetime(9999-01-01))),
            ShadowActivity = make_set(ShadowCmd),
            SuspiciousSvcs = make_set(SvcName),
            ExfilCommands = make_set(ExfilCmd)
  by Host
| where SignalCount >= 2
| order by SignalCount desc, FirstSeen asc;

# Security Arsenal — DEADLOCK Rapid Triage Script (Run elevated on suspect hosts / via GPO at scale)
# Checks the top pre-encryption indicators for DEADLOCK's playbook in one pass.
# Output: console + C:\DeadLockTriage_<hostname>.txt for evidence collection.

$report = "C:\DeadLockTriage_$env:COMPUTERNAME.txt"
"=== DEADLOCK Rapid Triage — $env:COMPUTERNAME — $(Get-Date -Format 'yyyy-MM-dd HH:mm') ===" | Out-File $report

# 1. Volume Shadow Copy status (DEADLOCK deletes these before detonation)
"`n[1] VOLUME SHADOW COPIES:" | Out-File $report -Append
try {
    $shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction Stop
    if ($shadows) { $shadows | Select-Object DeviceObject, InstallDate, VolumeName | Format-Table | Out-String | Out-File $report -Append }
    else { "  !! NO SHADOW COPIES PRESENT — possible vssadmin deletion !!" | Out-File $report -Append }
} catch { "  Error querying shadow copies: $_" | Out-File $report -Append }
"  vssadmin deletion artifacts in event log:" | Out-File $report -Append
Get-WinEvent -FilterHashtable @{LogName='System'; Id=7036} -MaxEvents 50 -ErrorAction SilentlyContinue |
  Where-Object {$_.Message -match 'Volume Shadow Copy'} | Select-Object TimeCreated, Message |
  Format-Table -AutoSize | Out-String | Out-File $report -Append

# 2. Scheduled tasks created in the last 7 days (persistence + encryption launchers)
"`n[2] SCHEDULED TASKS CREATED LAST 7 DAYS:" | Out-File $report -Append
Get-ScheduledTask | Where-Object {
    $_.Date -and ([datetime]$_.Date) -gt (Get-Date).AddDays(-7)
} | Select-Object TaskName, TaskPath, Date, @{N='Action';E={$_.Actions.Execute}} |
  Format-Table -AutoSize | Out-String | Out-File $report -Append

# 3. Suspicious services (PsExec-style, Temp-path binaries, rogue RMM)
"`n[3] SUSPICIOUS SERVICES:" | Out-File $report -Append
Get-CimInstance Win32_Service | Where-Object {
    $_.PathName -match 'Temp|AppData|ADMIN\$|PSEXESVC|paexec' -or
    $_.Name -match 'ScreenConnect|PSEXESVC'
} | Select-Object Name, State, StartMode, PathName | Format-Table -AutoSize | Out-String | Out-File $report -Append

# 4. Exposed RDP check + recent RDP logons (initial access validation)
"`n[4] RDP EXPOSURE & RECENT LOGONS:" | Out-File $report -Append
$rdpEnabled = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections).fDenyTSConnections
"  RDP fDenyTSConnections = $rdpEnabled (0 = ENABLED — verify it is not internet-exposed)" | Out-File $report -Append
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624; LogonType=10} -MaxEvents 25 -ErrorAction SilentlyContinue |
  Select-Object TimeCreated, @{N='User';E={$_.Properties[1].Value}}, @{N='SourceIP';E={$_.Properties[18].Value}} |
  Format-Table -AutoSize | Out-String | Out-File $report -Append

# 5. Known exfil/archiving tooling presence
"`n[5] EXFIL/STAGING TOOL PRESENCE:" | Out-File $report -Append
$tools = @('rclone.exe','7z.exe','rar.exe','megasync.exe','filezilla.exe')
foreach ($t in $tools) {
    $found = Get-ChildItem -Path 'C:\' -Filter $t -Recurse -ErrorAction SilentlyContinue -Depth 4 | Select-Object -First 3
    if ($found) { "  FOUND: $t" | Out-File $report -Append; $found.FullName | Out-File $report -Append }
}

"`n=== Triage complete. If sections 1, 2, or 3 show hits — isolate host NOW and engage IR. ===" | Out-File $report -Append
Write-Host "Report written to $report" -ForegroundColor Yellow

Incident Response Priorities — DEADLOCK Playbook

T-Minus Detection Checklist (Before Encryption Fires)

1. Shadow copy deletion commands (vssadmin delete shadows, bcdedit recoveryenabled no) — the single highest-fidelity pre-detonation signal. If seen, assume encryption is minutes-to-hours away.
2. Mass file archive creation — large .rar/.7z jobs on file servers, especially with password flags (-hp).
3. Rclone/MEGA/FileZilla execution on servers — DEADLOCK exfiltrates before encrypting; outbound gigabytes to consumer cloud storage is your last window.
4. New scheduled tasks named innocuously (WindowsUpdate, DefenderScan) pointing at payloads in %TEMP% or %AppData%.
5. PsExec service artifacts (PSEXESVC in System event ID 7045) on hosts that administrators did not touch.
6. Anomalous VPN gateway authentication logs — Check Point IKEv1 sessions from unexpected geographies (see CVE-2026-50751).

Critical Assets DEADLOCK Historically Prioritizes for Exfiltration

• File shares containing HR, legal, and financial records (payroll, contracts, PII)
• Operational data — for transportation/logistics victims: cargo manifests, customs filings, terminal operating system exports, client shipping data
• Email archives from executive mailboxes (especially where Exchange CVE-2023-21529 was leveraged)
• Backup infrastructure credentials and Veeam/Commvault consoles — targeted for both theft and destruction

Containment Actions (Ordered by Urgency)

1. Isolate affected VLANs/hosts at the switch level — do not rely on OS-level commands on potentially compromised machines.
2. Disable the compromised VPN gateway's remote access or take the appliance offline if CVE-2026-50751 exploitation is unconfirmed but suspected.
3. Reset credentials en masse — domain admin, service accounts, and any account with interactive logons in the intrusion window. Assume Kerberos tickets are harvested; plan a double krbtgt reset.
4. Block known exfil destinations (MEGA, rclone remotes, anonymous FTP) at the egress proxy and inspect the last 14 days of netflow for large outbound transfers.
5. Preserve evidence before remediation — memory capture on the patient-zero host, VPN gateway logs, and the suspicious scheduled tasks/services identified by the triage script.
6. Engage IR retainer and legal/comms counsel — leak-site posting means a negotiation clock is already running.

Hardening Recommendations

Immediate (24 Hours)

• Patch or mitigate CVE-2026-50751 (Check Point IKEv1 improper authentication) on all Security Gateways. If patching is not possible today, disable IKEv1-based VPN communities and restrict gateway management interfaces to a dedicated management VLAN. This is the highest-probability entry point for this campaign.
• Patch ConnectWise ScreenConnect (CVE-2024-1708) to the latest build or retire the instance; audit for rogue extensions/plugins installed post-compromise.
• Apply Exchange cumulative updates covering CVE-2023-21529 and audit for webshells in aspnet_client and owa/auth directories.
• Apply Windows patches covering CVE-2025-60710 (link-following privilege escalation) to close the escalation leg of the kill chain.
• Block RDP at the perimeter (TCP/3389) and require VPN + MFA for any remote administration; hunt the last 30 days of logon type 10 events.
• Deploy the Sigma rules and KQL query above and run the PowerShell triage script against internet-facing and Tier-0 assets.
• Verify Volume Shadow Copies exist and backup jobs succeeded on all file servers — and confirm backups are offline/immutable.

Short-Term (2 Weeks)

• Architectural egress control: default-deny outbound for server VLANs; allow-list only sanctioned backup/update destinations. This single control would have broken DEADLOCK's exfiltration phase.
• RMM governance: inventory every remote access tool in the estate; anything not on the approved list gets blocked by AppLocker/WDAC and alerted on execution.
• Segment operational technology and logistics systems (terminal operating systems, cargo platforms) from corporate AD — transportation victims demonstrate DEADLOCK will reach operational data if it shares a trust boundary.
• Deploy decoy file shares and canary credentials to catch pre-encryption enumeration, which precedes DEADLOCK's staging by days.
• Tabletop the double-extortion scenario with legal and comms: decide now whether the organization will engage a negotiator, and pre-draft regulatory notification paths for UK ICO, Taiwanese and Turkish data protection authorities given this campaign's geography.

Analyst Assessment

DEADLOCK's current burst is opportunistic, scan-driven, and edge-device-led — the GB/TW/TR dispersion rules out a targeted regional operation. The Check Point IKEv1 flaw (CVE-2026-50751) is the most probable common denominator and should be treated as the primary exposure until victim forensics say otherwise. The transportation sector hit is the most consequential: terminal operators and logistics firms should assume they are in the scanning pool and verify gateway patch status today. Expect a second wave of postings within 7–10 days based on this group's historical burst cadence.

Security Arsenal will continue monitoring the DEADLOCK .onion leak site and will update this bulletin as new victims are posted.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub