Deadlock
Also known as DeadLock
Reports
111
First seen
Mar 19, 2026
Last seen
Oct 12, 2026
Motivation
Financial
Targeting
Sectors
Victim regions
×2×10
Spain×10
Italy×6
Poland×5
United States×5
Türkiye×4
Sweden×3
Czechia×2
Brazil×2
Victim country, only when stated. Corpus is predominantly English-language reporting, so US/EU coverage is overweighted relative to true victim distribution.
Top ATT&CK techniques
T1490 Inhibit System Recovery ×3T1486 Data Encrypted for Impact ×3T1562.001 Impair Defenses: Disable or Modify Tools ×3T1005 Data from Local System ×2T1543.003 Create or Modify System Process: Windows Service ×2T1068 Exploitation for Privilege Escalation ×1T1562.009 Impair Defenses: Safe Mode Boot ×1T1112 Modify Registry ×1T1059.003 Command and Scripting Interpreter: Windows Command Shell ×1T1053 Scheduled Task/Job ×1T1567 Exfiltration Over Web Service ×1T1059.001 Command and Scripting Interpreter: PowerShell ×1
Indicators
domain ×158filename ×51ip_v4 ×42hash_md5 ×6hash_sha1 ×5ethereum_address ×4registry_key ×3url ×2email ×2bitcoin_address ×1hash_sha256 ×1
Indicator values are available on Pro and via the API.
Recent reports
High