Classification: TLP:CLEAR | Publication Date: 2026-11-09 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

DEADLOCK Ransomware Gang: 6 New Leak-Site Listings Posted — Sector Targeting Analysis & Detection Rules

Executive Summary

On 2026-11-08, the DEADLOCK ransomware gang published six new listings on its dark web leak site, naming organizations across Retail & E-Commerce, Agriculture and Food Production, Manufacturing, and uncategorized sectors spanning Mexico, the United States, Costa Rica, and Thailand. Every listing in this batch is single-source — observed only via ransomware.live with no second-crawler confirmation. These are unverified claims by a criminal actor; inclusion does not confirm that any named organization was breached.

The named organizations are Fidex (MX), NoseTea (US, Retail & E-Commerce), Coopexx (CR, Agriculture and Food Production), Trinity Custom Homes - USA (US, Manufacturing), Chonlatee (TH), and Kadick (US). The concentration of small-to-midsize organizations across four countries in a single posting day is consistent with DEADLOCK's established pattern of opportunistic, high-volume targeting of organizations with exposed remote access infrastructure and unpatched edge services.

Security teams in the affected sectors — particularly retail, agriculture, manufacturing, and construction — should treat this as a signal to immediately audit VPN and RDP exposure, validate EDR coverage on servers and domain controllers, and confirm that backup infrastructure is segmented and immutable. The detection content in this briefing targets DEADLOCK's known tradecraft for initial access, lateral movement, and pre-encryption staging.

Sourcing & Verification

Of the six listings reported in this briefing, zero were independently observed by a second leak-site crawler; all six appear on a single source only (ransomware.live). Inclusion in this briefing reflects the threat actor's claim as posted on the DEADLOCK leak site. It is not confirmation that a breach occurred.

A named organization may dispute the listing. A denial is likewise not proof that the claim is false — disclosure obligations vary by jurisdiction, sector, and data type, and not every incident is reportable. Neither silence nor denial settles the question. Only the organization itself, its counsel, or its regulator can confirm or deny an incident.

Security Arsenal will publish corrections if warranted and welcomes contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — DEADLOCK

Aliases: DEADLOCK operates under its primary name with no widely confirmed aliases in open-source reporting. Some cluster tracking associates DEADLOCK with rebranded infrastructure from earlier mid-tier RaaS operations, though attribution remains fluid.

Operating Model: DEADLOCK functions as a Ransomware-as-a-Service (RaaS) operation with a closed affiliate structure. The core team maintains the leak site, negotiation infrastructure, and payload builder while a limited number of affiliates conduct intrusions. This closed model means victim volume is lower than open RaaS programs, but TTP consistency across campaigns is higher.

Ransom Demands: Observed demands range from $50,000 to $1.2 million USD depending on victim size and perceived ability to pay. DEADLOCK negotiates exclusively via a Tor-based portal and provides a countdown timer on its leak site with escalating data release threats.

Initial Access Methods: DEADLOCK affiliates rely heavily on opportunistic external access rather than targeted spear-phishing. Documented vectors include:

• Exploitation of unpatched VPN and firewall appliances (Fortinet, Cisco, Check Point)
• Brute-force and credential-stuffing attacks against exposed RDP services
• Phishing emails with macro-enabled Office documents or malicious ISO/IMG attachments leading to loader deployment
• Exploitation of CI/CD pipeline tools and exposed management interfaces

Extortion Model: Double extortion. DEADLOCK exfiltrates data before detonating encryption and threatens publication on its leak site if ransom is not paid. The gang also lists victim data in staged releases to increase pressure.

Average Dwell Time: Estimated 4 to 11 days from initial access to encryption detonation based on incident response reporting. Some intrusions have progressed in under 72 hours when the affiliate found flat network architecture with no segmentation.

Current Campaign Analysis

Sector Targeting

The six listings span four identified sectors and two uncategorized entries:

The absence of healthcare or financial services in this batch is notable. DEADLOCK's historical pattern favors organizations with high operational disruption sensitivity but relatively lower regulatory scrutiny — retail, agriculture, light manufacturing, and construction fit this profile precisely.

Geographic Concentration

The United States accounts for half of the listings (3 of 6), with Mexico, Costa Rica, and Thailand each contributing one. The spread across North America, Central America, and Southeast Asia suggests opportunistic scanning rather than region-specific targeting. Organizations in Latin America and Southeast Asia with weaker patch management and EDR coverage appear increasingly represented in DEADLOCK postings over recent months.

Victim Profile

Based on the named organizations and their sectors, the victim profile skews toward small-to-midsize businesses with estimated annual revenues between $5 million and $80 million. These are organizations large enough to pay a meaningful ransom but typically lacking a dedicated security operations center, 24/7 monitoring, or segmented backup infrastructure. Trinity Custom Homes - USA, for example, operates in the residential construction vertical — a sector where project timelines create extreme pressure to restore operations quickly, increasing ransom payment likelihood.

Posting Frequency and Escalation

All six listings appeared on a single day (2026-11-08). This batch-posting pattern is consistent with DEADLOCK's behavior of accumulating intrusions and releasing victim names in waves to maximize visibility and negotiation pressure. The last 100 postings on the DEADLOCK leak site represent a sustained operational tempo. There is no evidence in this batch of escalation to full data publication — all listings appear to be in the initial naming-and-demanding phase.

CVE Exposure Correlation (Hypothesis)

No evidence directly links any specific CVE to any specific named organization in this batch. However, DEADLOCK affiliates are known to scan for and exploit the following vulnerability classes, all of which appear on the CISA Known Exploited Vulnerabilities catalog with confirmed ransomware use:

• CVE-2026-50751 (Check Point Security Gateway — Improper Authentication in IKEv1): Directly relevant to DEADLOCK's known pattern of VPN appliance exploitation. Organizations running Check Point gateways with IKEv1 enabled should treat this as a critical exposure.
• CVE-2026-20316 (Cisco Secure FMC — Hard-coded Password): Relevant to organizations using Cisco Firepower/Secure Firewall management infrastructure. Hard-coded credentials in management interfaces align with DEADLOCK's preference for low-effort initial access.
• CVE-2026-59310 (Broadcom VMware vCenter — Path Traversal): Post-exploitation pivot into virtualization infrastructure. DEADLOCK is known to target hypervisors for mass encryption of virtual machine datastores.
• CVE-2026-63077 (JetBrains TeamCity — Deserialization of Untrusted Data): CI/CD pipeline compromise enabling code signing abuse and lateral movement into build infrastructure.
• CVE-2026-48027 (Nx Console — Embedded Malicious Code): Supply chain vector through development tooling.

These CVEs represent the attack surface DEADLOCK is positioned to exploit. Organizations in the affected sectors should audit exposure to these products immediately.

Detection Engineering

The following detection content targets DEADLOCK's documented TTPs across initial access, lateral movement, and pre-encryption staging.

---
title: DEADLOCK - Suspicious RDP Logon Followed by Process Execution
id: 7a3e9c1d-4f2b-4e8a-b1c3-9d5f6a2e8b01
status: experimental
description: Detects successful RDP logon from external IP followed within 15 minutes by execution of reconnaissance or lateral movement tools. Associated with DEADLOCK initial access via RDP brute force.
author: Security Arsenal Threat Intelligence
references:
  - https://securityarsenal.com/darkside
logsource:
  product: windows
  service: security
detection:
  selection_logon:
    EventID: 4624
    LogonType: 10
  selection_process:
    EventID: 4688
    NewProcessName|endswith:
      - '\nluser.exe'
      - '\quser.exe'
      - '\systeminfo.exe'
      - '\ipconfig.exe'
      - '\netstat.exe'
      - '\arp.exe'
      - '\nltest.exe'
      - '\net.exe'
      - '\net1.exe'
      - '\whoami.exe'
      - '\tasklist.exe'
  condition: selection_logon and selection_process
  timeframe: 15m
falsepositives:
  - Legitimate administrator RDP sessions followed by system queries
  - Automated management tools using RDP for remediation
level: high
tags:
  - attack.initial_access
  - attack.t1078
  - attack.t1021.001
  - attack.discovery
---
title: DEADLOCK - PsExec or WMI Remote Service Creation for Lateral Movement
id: 8b4f0d2e-5a3c-4f9b-c2d4-0e6a7b3f9c02
status: experimental
description: Detects creation of new services on remote systems via PsExec or WMI, a hallmark of DEADLOCK lateral movement using compromised credentials.
author: Security Arsenal Threat Intelligence
references:
  - https://securityarsenal.com/darkside
logsource:
  product: windows
  service: system
detection:
  selection:
    EventID: 7045
    ServiceName|contains:
      - 'PSEXESVC'
      - 'PAExec'
      - 'csexec'
      - 'RemCom'
  selection_wmi:
    EventID: 7045
    ImagePath|contains:
      - 'wmiprvse'
      - 'WmiPrvSE'
  condition: selection or selection_wmi
falsepositives:
  - Legitimate IT administration using PsExec for patch deployment
  - SCCM or similar endpoint management pushing software
level: high
tags:
  - attack.lateral_movement
  - attack.t1021.002
  - attack.t1569.002
---
title: DEADLOCK - Pre-Encryption Staging via Volume Shadow Copy Deletion and Data Archive
id: 9c5a1e3f-6b4d-4a0c-d3e5-1f7b8c4a0d03
status: experimental
description: Detects deletion of Volume Shadow Copies combined with creation of large archive files, consistent with DEADLOCK pre-encryption data staging and anti-recovery actions.
author: Security Arsenal Threat Intelligence
references:
  - https://securityarsenal.com/darkside
logsource:
  category: process_creation
  product: windows
detection:
  selection_vss:
    CommandLine|contains:
      - 'vssadmin delete shadows'
      - 'vssadmin.exe delete shadows'
      - 'wmic shadowcopy delete'
      - 'bcdedit'
      - 'wbadmin delete catalog'
  selection_archive:
    Image|endswith:
      - '\7z.exe'
      - '\rar.exe'
      - '\winrar.exe'
  condition: selection_vss or selection_archive
falsepositives:
  - System administrators performing legitimate shadow copy cleanup
  - Backup software managing VSS snapshots
  - Legitimate use of compression utilities by users
level: critical
tags:
  - attack.impact
  - attack.t1490
  - attack.t1560.001
  - attack.exfiltration

// DEADLOCK Pre-Ransomware Staging Hunt — Microsoft Sentinel
// Hunts for evidence of data staging, shadow copy deletion, and mass file modification
// across endpoints within a 7-day lookback window

let LookbackPeriod = 7d;

// Hunt 1: Volume Shadow Copy deletion attempts
let VSSDeletion = SecurityEvent
| where TimeGenerated >= ago(LookbackPeriod)
| where EventID == 4688
| where CommandLine has_any ("vssadmin delete shadows", "wmic shadowcopy delete", "bcdedit", "wbadmin delete catalog")
| project TimeGenerated, Computer, Account, CommandLine, ProcessName = NewProcessName, ParentProcessName
| extend IndicatorType = "VSS Deletion";

// Hunt 2: Suspicious archive creation (data staging for exfiltration)
let ArchiveCreation = DeviceProcessEvents
| where TimeGenerated >= ago(LookbackPeriod)
| where FileName has_any ("7z.exe", "rar.exe", "winrar.exe")
| where ProcessCommandLine has_any (" a ", " -p", "recurse")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, FolderPath
| extend IndicatorType = "Archive Staging";

// Hunt 3: Mass file modification pattern (encryption precursor)
let MassFileMod = DeviceFileEvents
| where TimeGenerated >= ago(LookbackPeriod)
| where ActionType == "FileModified" or ActionType == "FileRenamed"
| summarize FileModCount = count(), UniqueExtensions = dcount(FileExtension), SampleFiles = make_set(FileName, 10) by DeviceName, InitiatingProcessFileName, InitiatingProcessAccountName, bin(TimeGenerated, 5m)
| where FileModCount > 200 and UniqueExtensions > 15
| extend IndicatorType = "Mass File Modification";

// Hunt 4: Cobalt Strike-style named pipe creation
let NamedPipes = DeviceEvents
| where TimeGenerated >= ago(LookbackPeriod)
| where ActionType == "NamedPipeEvent"
| where AdditionalFields has_any ("msagent", "postex", "status_", "interprocess")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, AdditionalFields
| extend IndicatorType = "Suspicious Named Pipe";

// Combine all hunts
union VSSDeletion, ArchiveCreation, MassFileMod, NamedPipes
| order by TimeGenerated desc

# DEADLOCK Rapid Response Assessment Script
# Run as Administrator on any Windows server suspected of DEADLOCK staging activity
# Checks: RDP exposure, recent scheduled tasks, VSS status, suspicious services

Write-Host "=== DEADLOCK Rapid Response Assessment ===" -ForegroundColor Cyan
Write-Host "Timestamp: $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss UTC' )`n" -ForegroundColor Gray

# 1. Check RDP exposure and recent RDP logons
Write-Host "[1] RDP Configuration & Recent Logons" -ForegroundColor Yellow
$rdpEnabled = (Get-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server').fDenyTSConnections
if ($rdpEnabled -eq 0) {
    Write-Host "  [!] RDP is ENABLED on this system" -ForegroundColor Red
    $rdpPort = (Get-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp').PortNumber
    Write-Host "  [i] RDP Port: $rdpPort" -ForegroundColor White
} else {
    Write-Host "  [OK] RDP is disabled" -ForegroundColor Green
}

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624; StartTime=(Get-Date).AddDays(-7)} -MaxEvents 50 -ErrorAction SilentlyContinue |
    Where-Object { $_.Properties[8].Value -eq 10 } |
    Select-Object TimeCreated, @{N='Account';E={$_.Properties[5].Value}}, @{N='SourceIP';E={$_.Properties[18].Value}} |
    Format-Table -AutoSize

# 2. Scheduled tasks created in last 7 days
Write-Host "`n[2] Scheduled Tasks Created in Last 7 Days" -ForegroundColor Yellow
Get-ScheduledTask | Where-Object { $_.Date -and [datetime]$_.Date -gt (Get-Date).AddDays(-7) } |
    Select-Object TaskName, TaskPath, Date, @{N='Author';E={$_.Author}}, State |
    Format-Table -AutoSize

# 3. Volume Shadow Copy status
Write-Host "`n[3] Volume Shadow Copy Status" -ForegroundColor Yellow
$vssStatus = Get-Service VSS -ErrorAction SilentlyContinue
if ($vssStatus.Status -eq 'Running') {
    Write-Host "  [OK] VSS service is running" -ForegroundColor Green
} else {
    Write-Host "  [!] VSS service status: $($vssStatus.Status)" -ForegroundColor Red
}

$shadows = vssadmin list shadows 2>&1
if ($shadows -match "No items found") {
    Write-Host "  [CRITICAL] No shadow copies exist — possible anti-recovery action" -ForegroundColor Red
} else {
    Write-Host "  [OK] Shadow copies present" -ForegroundColor Green
}

# 4. Recently created services (potential PsExec/remote service persistence)
Write-Host "`n[4] Services Created in Last 7 Days" -ForegroundColor Yellow
Get-WinEvent -FilterHashtable @{LogName='System'; Id=7045; StartTime=(Get-Date).AddDays(-7)} -MaxEvents 20 -ErrorAction SilentlyContinue |
    Select-Object TimeCreated, @{N='ServiceName';E={$_.Properties[0].Value}}, @{N='ImagePath';E={$_.Properties[1].Value}} |
    Format-Table -AutoSize

# 5. Check for common DEADLOCK staging directories
Write-Host "`n[5] Checking Common Staging Directories" -ForegroundColor Yellow
$stagingPaths = @("C:\ProgramData\*.zip", "C:\ProgramData\*.7z", "C:\ProgramData\*.rar", "C:\Windows\Temp\*.zip", "C:\Users\Public\*.zip", "C:\Users\Public\*.7z")
foreach ($path in $stagingPaths) {
    $found = Get-ChildItem -Path $path -ErrorAction SilentlyContinue
    if ($found) {
        Write-Host "  [!] Suspicious archive found: $($found.FullName) (Size: $([math]::Round($found.Length/1MB,2)) MB)" -ForegroundColor Red
    }
}

Write-Host "`n=== Assessment Complete ===" -ForegroundColor Cyan
Write-Host "If any CRITICAL findings, isolate this host from the network immediately and engage IR." -ForegroundColor Red

Incident Response Priorities

T-Minus Detection Checklist (Before Encryption Fires)

DEADLOCK's average dwell time of 4–11 days provides a detection window. Hunt for these indicators in order:

1. External RDP or VPN logons from unusual source IPs — particularly logons outside business hours or from geographies inconsistent with your user base
2. Credential dumping tool execution — LSASS memory access by non-system processes, presence of procdump, comsvcs.dll MiniDump invocations, or Mimikatz-style PowerShell
3. New administrative accounts or privilege escalation — Event IDs 4720 (account creation), 4728/4732/4756 (group membership changes)
4. PsExec or WMI service creation on multiple hosts in rapid succession — indicates lateral movement tooling deployment
5. Volume Shadow Copy deletion or backup catalog destruction — the strongest pre-encryption signal
6. Large archive file creation in non-standard locations — data staging for exfiltration
7. Unusual outbound data transfer volumes — particularly to cloud storage services or IPs in non-standard geographies

Critical Exfiltration Targets

DEADLOCK prioritizes the following data categories based on observed leak site releases:

• Financial records (accounting databases, payroll files, tax documents)
• Customer PII and contact databases
• Contracts and legal agreements
• Proprietary designs, blueprints, and engineering files (particularly relevant for manufacturing and construction targets)
• Email archives from executive accounts
• Active Directory dumps and credential databases

Containment Actions (Ordered by Urgency)

1. Isolate affected hosts from the network — do NOT power off (preserve volatile memory for forensics)
2. Block outbound traffic from affected segments to the internet at the firewall level
3. Disable compromised accounts and force password resets for all accounts with administrative privileges
4. Revoke active sessions and tokens across identity providers (Entra ID, Okta, etc.)
5. Verify backup integrity — confirm that backup repositories are segmented, immutable, and have not been accessed by the attacker
6. Engage incident response — internal team or external retainer
7. Preserve evidence — capture memory dumps, firewall logs, VPN logs, and authentication logs before remediation
8. Assess regulatory notification obligations — involve legal counsel early; breach notification timelines vary by jurisdiction and data type

Hardening Recommendations

Immediate (24 Hours)

1. Disable RDP from the internet. If RDP is required, restrict to specific source IPs via firewall ACL and enforce Network Level Authentication (NLA). Audit current exposure with external scanning.
2. Patch all Check Point Security Gateway instances for CVE-2026-50751. If IKEv1 is not operationally required, disable it entirely.
3. Patch Cisco Secure FMC for CVE-2026-20316. Rotate any credentials that may be affected by hard-coded password exposure.
4. Enable MFA on all remote access services — VPN, RDP gateways, web portals. DEADLOCK's initial access overwhelmingly targets services without MFA.
5. Audit and restrict administrative privileges — remove standing domain admin rights from daily-use accounts. Implement tiered administration.
6. Verify VSS protection — ensure shadow copies exist and are protected. Configure alerts for any vssadmin delete or bcdedit execution.
7. Review EDR coverage — confirm all servers, domain controllers, and hypervisor hosts have active EDR agents with tamper protection enabled.

Short-Term (2 Weeks)

1. Segment backup infrastructure — place backup repositories on isolated network segments with separate credentials, no domain trust, and immutable storage enabled. Test restoration from backup.
2. Implement network segmentation between user workstations, servers, and critical infrastructure. DEADLOCK's fast dwell time is enabled by flat networks.
3. Deploy honeypot credentials and canary files — decoy administrative credentials and file shares that trigger immediate alerts when accessed.
4. Patch vCenter infrastructure for CVE-2026-59310. Restrict vCenter management interface access to a dedicated management VLAN.
5. Audit CI/CD pipeline security — patch TeamCity instances for CVE-2026-63077, review build agent permissions, and implement code signing verification.
6. Establish outbound traffic baselines — implement alerting on anomalous data transfer volumes and connections to non-standard destinations.
7. Conduct tabletop exercise simulating DEADLOCK-style double extortion. Ensure the IR plan covers leak site monitoring, negotiation decisions, and regulatory notification workflows.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub