DeadLock is a Windows file-encrypting strain that renames affected data with the .dlock suffix, swaps the desktop background and alters file icons. Victims find a text instruction file and an HTML page, named in the form HOW_RECOVER.[ID].txt and RECOVERY_CHAT.[ID].html, where the [ID] part is unique to each victim, that steer them to a chat on the Session messenger rather than to email. The operators run attacks against businesses, chiefly manufacturing, engineering and professional services. Early builds made no mention of stolen data, while later builds assert that company data was copied and threaten its sale, and the HTML chat page has been observed retrieving its contact details through Polygon smart contracts. No affiliate programme or lineage to an earlier family is established.
File extensions: .dlock
Ransom note filenames: HOW_RECOVER.txt, RECOVERY_CHAT.html
Decryptor: No public decryptor was found. Checked 2026-10-14.
The ransomware identification tool didn’t load. This is usually temporary — please refresh. If you’re dealing with an active incident, don’t wait on it:
Emergency response: +1 (877) 364-5161