Aliases: None confirmed (Single operation under DEADLOCK brand).
Operational Model: RaaS (Ransomware-as-a-Service) traits observed, though potentially a closed, high-skill affiliate group given the sophistication of the initial access vectors targeting network perimeters.
Ransom Demands: High-value demands typically ranging from $500k to $5M USD, largely dependent on the victim's revenue and the sensitivity of exfiltrated data (specifically CAD/IP for manufacturing).
Initial Access: DEEPLOCK has aggressively pivoted from standard phishing to exploiting edge networking infrastructure. Recent campaign data strongly correlates initial access with vulnerabilities in VPNs (Check Point) and Firewalls (Cisco FMC), alongside legacy remote management tools (ConnectWise ScreenConnect).
Tactics: Double extortion is standard. The group exfiltrates large volumes of data (often via rclone or custom FTP scripts) prior to encryption. Dwell time is estimated between 3 to 10 days, utilizing that time for lateral movement and harvesting credentials.
Current Campaign Analysis
Campaign Date: 2026-07-25
Sector Targeting: DEADLOCK is aggressively targeting the Manufacturing sector (40% of recent victims), specifically heavy industry and production. This is followed by Government & Defense (10%), Financial Services (10%), and Energy/Utilities (10%).
- Manufacturing: Vinilon (CL), HİDROMEK (TR), KEMEK (?), Carrier AB (SE)
- Professional Services: Schaad, Balass, Menzl and Partner AG (CH)
- Government & Defense: KeNHA (KE)
- Healthcare: BioResearch (PL)
- Energy: Enedo Power (FI)
- Financial Services: CNA (IT)
Geographic Concentration: The campaign is highly globalized, with no specific regional focus. Recent victims span South America (CL, AR), Europe (CH, TR, PL, SE, FI), Africa (KE), and an Italian financial entity (CNA, IT). This suggests a "spray and pray" vulnerability scanning approach rather than geo-targeted espionage.
Victim Profile: Targets are primarily mid-to-large enterprises. Victims like Carrier AB (multinational HVAC) and HİDROMEK (heavy construction machinery) represent high-revenue targets with complex OT/IT environments, suggesting DEADLOCK affiliates are capable of navigating or bypassing air-gapped segments.
CVE Correlation & Access Vectors: The recent spike in victims aligns perfectly with the exploitation of:
- CVE-2026-50751 (Check Point Security Gateway): Likely used for initial access into corporate VPNs, allowing the gang to bypass MFA in IKEv1 implementations.
- CVE-2026-20131 (Cisco Secure Firewall FMC): Used to pivot from network perimeter management to internal lateral movement.
- CVE-2024-1708 (ConnectWise ScreenConnect): A persistent favorite for ransomware groups to gain remote code execution (RCE) on helpdesk machines already exposed to the internet.
Detection Engineering
The following detection logic focuses on the specific initial access vectors and lateral movement observed in this DEADLOCK campaign.
Sigma Rules
title: Potential Check Point IKEv1 Exploitation (CVE-2026-50751)
id: 9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
description: Detects potential exploitation of CVE-2026-50751 involving IKEv1 authentication bypass or abnormal IKE negotiation patterns.
status: experimental
date: 2026/07/25
author: Security Arsenal Intel
references:
- https://cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
product: firewall
service: vpn
detection:
selection:
destination.port: 500
protocol: udp
vpn.protocol|contains: 'IKEv1'
filter_legit:
source.ip:
- '192.168.0.0/16'
- '10.0.0.0/8'
- '172.16.0.0/12'
condition: selection and not filter_legit
level: high
tags:
- attack.initial_access
- cve.2026.50751
- ransomware.deadlock
---
title: ConnectWise ScreenConnect Path Traversal Exploit (CVE-2024-1708)
id: b1c2d3e4-5a6b-7c8d-9e0f-1a2b3c4d5e6f
description: Detects path traversal attempts in ConnectWise ScreenConnect indicative of CVE-2024-1708 exploitation.
status: experimental
date: 2026/07/25
author: Security Arsenal Intel
references:
- https://cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
category: web
detection:
selection_uri:
cs-uri-query|contains:
- '..%2f'
- '..%5c'
- '..%255c'
selection_host:
cs-host|contains: 'ScreenConnect'
condition: all of selection_*
level: critical
tags:
- attack.initial_access
- attack.web_shell
- cve.2024.1708
- ransomware.deadlock
---
title: DEADLOCK Lateral Movement via PsExec and WMI
id: c3d4e5f6-7a8b-9c0d-1e2f-3a4b5c6d7e8f
description: Detects lateral movement patterns consistent with DEADLOCK operators using PsExec or WMI for deployment.
status: experimental
date: 2026/07/25
author: Security Arsenal Intel
logsource:
product: windows
service: security
detection:
selection_psexec:
EventID: 5145
ShareName|contains: 'IPC$'
RelativeTargetName|endswith: 'PSEXESVC'
selection_wmi:
EventID: 4688
NewProcessName|endswith:
- '\\wmic.exe'
- '\\powershell.exe'
CommandLine|contains:
- 'node And '
- 'call create'
condition: 1 of selection*
level: high
tags:
- attack.lateral_movement
- attack.t1021.002
- ransomware.deadlock
KQL (Microsoft Sentinel)
Hunt for lateral movement and pre-encryption staging, specifically looking for remote service creation and massive file operations typical of DEADLOCK.
DeviceProcessEvents
| where Timestamp > ago(7d)
// Hunt for PsExec or WMI service installation
| where ProcessCommandLine has_any (\"sc create\", \"net start\", \"psexec\", \"psexesvc\")
// Correlate with network connections to non-standard ports
| join kind=inner (
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemotePort in (445, 135, 5985, 5986)
) on DeviceId, Timestamp
// Filter for known DEADLOCK staging file extensions
| extend FileOps = iff(ProcessCommandLine has \".zip\" or ProcessCommandLine has \".7z\" or ProcessCommandLine has \".rar\", \"Archive\", \"Other\")
| where FileOps == \"Archive\"
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, RemoteIP, RemotePort, InitiatingProcessFileName
| top 100 by Timestamp desc
PowerShell - Rapid Response Script
This script checks for recent scheduled tasks (a common DEADLOCK persistence mechanism) and verifies the status of Volume Shadow Copies (often deleted prior to encryption).
# DEADLOCK Rapid Response Check
Write-Host \"[+] Checking for Scheduled Tasks created in the last 24 hours...\" -ForegroundColor Cyan
$Date = (Get-Date).AddDays(-1)
Get-ScheduledTask | Where-Object {$_.Date -ge $Date} | Select-Object TaskName, TaskPath, Date, Author, Actions
Write-Host \"[+] Checking Volume Shadow Copy Storage Status...\" -ForegroundColor Cyan
try {
$vss = vssadmin list shadows
if ($vss -like \"No shadow copies found\") {
Write-Host \"[!] CRITICAL: No Volume Shadow Copies found. Possible VSS deletion detected.\" -ForegroundColor Red
} else {
Write-Host \"[+] Shadow Copies present.\" -ForegroundColor Green
}
}
catch {
Write-Host \"[!] Error checking VSS: $_\" -ForegroundColor Yellow
}
Write-Host \"[+] Checking for recent unusual process executions (PsExec/WMI)...\" -ForegroundColor Cyan
Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4688; StartTime=(Get-Date).AddHours(-24)} -ErrorAction SilentlyContinue |
Where-Object {$_.Message -match 'psexec|wmic\.exe' -and $_.Message -notmatch 'C:\\Windows\\System32\'} |
Select-Object TimeCreated, Message | Format-List
---
# Incident Response Priorities
**T-Minus Detection Checklist:**
1. **VPN Logs:** Immediately audit Check Point and Cisco FMC logs for successful VPN logins originating from anomalous geolocations (non-business hours countries) or utilizing IKEv1.
2. **ScreenConnect:** Identify any internet-facing ScreenConnect instances. Check web logs for `App/WebCalendar` path traversal strings (`..%2f`, `..\\`).
3. **SMB Spikes:** Look for internal lateral movement spikes on ports 445/139 between workstations and servers, specifically looking for `IPC$` connections.
**Critical Assets for Exfiltration:**
Based on the Manufacturing victim profile:
* **CAD/PLM Databases:** High intellectual value.
* **ERP Systems:** (SAP, Oracle) for financial data.
* **Active Directory:** For domain dominance.
**Containment Actions (Order of Urgency):**
1. **Isolate VPN:** Immediately block inbound IKEv1 or require strict certificate-based authentication. Revoke VPN credentials for accounts showing anomalous usage.
2. **Disable RMM:** Temporarily shut down internet-facing RMM/ScreenConnect servers until patched.
3. **Network Segmentation:** Sever links between OT/IT environments if manufacturing floor systems are present.
---
# Hardening Recommendations
**Immediate (24 Hours):**
* **Patch CVE-2026-50751:** Apply the Check Point hotfix immediately. Disable IKEv1 globally on VPN gateways if not strictly required by legacy hardware.
* **Patch CVE-2024-1708:** Update ConnectWise ScreenConnect to the latest patched version. Restrict access to `/App/WebCalendar` endpoints via WAF if immediate patching is impossible.
* **MFA Enforcement:** Ensure all VPN and RDP access is protected by phishing-resistant MFA (FIDO2).
**Short-Term (2 Weeks):**
* **Perimeter Audit:** Conduct a vulnerability scan focused on external-facing firewalls and VPN concentrators.
* **Access Review:** Audit all local administrator accounts on critical servers to prevent PsExec-based lateral movement.
* **EDR Rollout:** Ensure EDR sensors are deployed on edge servers (VPN/Proxy jump boxes) to detect process injection early.
---
Related Resources
Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.