Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
13 IOCs
DeadLock ransomware: Breaking down a Rust-based encryptor with decentralized recovery infrastructure
Malware Families
Excerpt
In this article Pre-encryption Encryption Post-encryption Defending against DeadLock ransomware Indicators of compromise Microsoft Threat Intelligence tracks DeadLock ransomware as an emerging financially motivated operation distinguished by its use of decentralized infrastructure to support victim communications and data leak operations. Its recovery ecosystem combines the Session messaging network with blockchain-backed services that store and deliver resources used…
Read the original report →Diamond Model
Adversary
Infrastructure(6)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →13 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | dlock.liveblog365.com | High | Score 58/100 | First seen |
| Domain | deadlock.liveblog365.com | High | Score 58/100 | First seen |
| Domain | deadlockblog.medianewsonline.com | High | Score 58/100 | First seen |
| Domain | polygon-pokt.nodies.app | High | Score 58/100 | First seen |
| Domain | deadlockblog.great-site.net | High | Score 58/100 | First seen |
| Domain | polygon.meowrpc.com | High | Score 58/100 | First seen |
| SHA1 | 757984507c82c8da1d3969c535db5706eee6426c | Medium | Score 53/100 | First seen |
| Domain | polygon.drpc.org | High | Score 87/100 | First seen |
| Domain | polygon-bor-rpc.publicnode.com | Low | Score 32/100 | First seen |
| SHA1 | 8ef7c3e531d871d3b9d559722de77eb1dec19dae | Medium | Score 53/100 | First seen |
| Domain | polygon-rpc.com | High | Score 58/100 | First seen |
| SHA256 | a1fdf65020ce4a0f0940c793c6425baf8a0b994ec48b9baaf72788661a9d29f4 | Medium | Score 53/100 | First seen |
| Domain | deadblogdbdu5wprek7wa2o4ce7rnt6u6ntqeud3hzjjcveosgpsqqqd.onion | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…