Overview
Deadlock is a ransomware leak-site brand that the tracker lists from mid-2026, with 106 victims in 42 countries. Italy, Spain, the United States, and Poland are the most frequent, and six claims name organizations in Türkiye, mostly manufacturers and logistics operators. We hold little public technical reporting on it.
- First tracked: 2026-06-15
- Discussed in our reports: Türkiye
Geography: origin and targets
No public attribution of origin. Lines are drawn only where public reporting places the operators; flags show where the group has claimed victims, sized by number of claims.
Italy12
Spain11
United States of America7
Poland7
Türkiye6
Argentina4
Germany4
Sweden3
Mexico3
Brazil3
Exploited vulnerabilities
None recorded in the sources we reviewed.
ATT&CK techniques
None recorded in the sources we reviewed.
Tools
None recorded in the sources we reviewed.
Leak-site infrastructure
| Title | Type | Address (defanged) | Seen online at snapshot |
|---|---|---|---|
| Deadlock - Blog | DLS | deadblogdbdu5wprek7wa2o4ce7rnt6u6ntqeud3hzjjcveosgpsqqqd[.]onion | Yes |
| DNS Resolution Error - Domain Not Found, Or Domain not added to hosting account | DLS | deadlock[.]liveblog365[.]com | Yes |
Sources and caveats
Group descriptions, ATT&CK mappings, tools and leak-site locations come from public ransomware tracking projects, including ransomware.live and Crocodyli. Exploited vulnerabilities come from the Ransomware-Vulnerability-Matrix by BushidoUK (licensed CC BY 4.0), supplemented where a group profile there is newer than the data we hold. Each CVE links to its original research source. Technical text is shown in English as published. Leak-site addresses are defanged and shown for blocking and detection; do not visit them. Nothing here is verified by ClairSec_ against a specific incident.
Data snapshot: 2026-10-11