File · Deadlock · Crime · ransomware.live · refreshed 2026-10-06
Deadlock
sigil · no ATT&CK coverage stated
Last 30 days
last seen yesterday- seen against
- Greece · United States
- sectors
- Manufacturing · Other
What changed
ledger · newest first- —27 d agoresurfacedback on the wire after 14 quiet days
Analyst brief
ransomware.liveDeadlock is an active ransomware/extortion group tracked on ransomware.live from the victims it lists on its public leak site.
Observed targets (as stated by the sources)
7 countries · 5 sectorsassessed originnot stated by sourcesobserved targets · 7
countries · 7
- United States
- Greece
- South Africa
- United Kingdom
- Taiwan
- Türkiye
- Philippines
sectors · 5
- Other
- Manufacturing
- Not Found
- Professional Services
- Transportation
as stated by MISP galaxy / ransomware.live — not inferred
Victims
leak-site listings via ransomware.live| Victims observed | First observed | Last observed on leak site | Lifetime rate | Last 30 days |
|---|---|---|---|---|
| 8 | ≈ 2.0 / month | above the lifetime rate 5 |
- Victims observed
- 8
- First observed
- Last observed on leak site
- Lifetime rate
- ≈ 2.0 / month
- Last 30 days
- above the lifetime rate 5
lifetime rate = victims ÷ months from first to last observed · ▲ above that rate is worse · a quiet leak site says nothing about the crew
Take it with you
keyless · no signupReferences
1 sourceTrack Deadlock on the wire.
This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.