Deadlock · Ransomware · RaqibCTI

Knowledge/Actors/DeadlockCorpus

+ Request intel workspace

ransomware

Deadlock

Provisional

Ransomware

Motivation

—

Attribution confidence

Provisional — not yet assessed

Provisional profile auto-created from leak-site claims — not analyst-vetted. A group's self-claim of a victim, not a confirmed breach.

Why it mattersRansomware actor, unrated confidence.

What's nextNo pipeline reports reference this actor yet — Radar mentions may still surface early signal.

No open hunts or recent alerts tracked against this actor right now.

Associated with

Targets

Global Terminal ServicestargetLeak-site claim · ransomware.live2026-08-19
AHENK labtargetLeak-site claim · ransomware.live2026-07-28
Maxplast AND SenocotargetLeak-site claim · ransomware.live2026-07-10
Güven Mühendislik MakinatargetLeak-site claim · ransomware.live2026-07-10
HİDROMEKtargetLeak-site claim · ransomware.live2026-06-30
SECiLtargetLeak-site claim · ransomware.live2026-05-22

Overview Attribution¹ TTPs Indicators Reporting Coverage

Indicators

No indicators linked yet

IOC extraction runs nightly against new reporting on this actor. Check back after tomorrow's corpus refresh.

Useful?

Related

Semantically related in the corpus — a discovery aid, not asserted attribution.

Actorlockbit5
DetectionDeadLock Ransomware - Pre-Encryption Service Stop (Backup and Security Services)
DetectionDeadLock Ransomware - Encrypted File Extension .dlock
DetectionDeadLock Ransomware - Security and Backup Process Termination
DetectionDeadLock Ransomware - Multi-Channel Event Log Clearing
DetectionDeadLock Ransomware - Ransom Note and Wallpaper BMP Artifact Creation