Ransomware Group intelligence
Deadlock
ActiveTrack Deadlock with 125 published victims and 3 known leak locations in a single intelligence view.
BREACH HOUSE ALERTS
Want an alert every time a new ransomware post is published?
Choose the feeds and the countries you care about — we email you when they move.
Overview
Deadlock is tracked by Breach House as a ransomware group with 125 published victims.
Italy is currently the most targeted country in this dataset.
3 known leak locations are currently associated with this group.
Leak Status Distribution
125
- Leaked 18 14.4%
- Pending 103 82.4%
- Deleted 4 3.2%
Top Countries
Interactive distribution based on the currently visible victims list.
Known Leak Locations (3)
| Label | Type | Availability | Links |
|---|---|---|---|
| File host (third party) | Third-party file host | Up checked 3h ago | www.swisstransfer.com |
| Leak location 2 | Onion service | Up checked 3h ago | deadblogdbdu5wprek7wa2o4ce7rnt6u6ntqeud3hzjjcveosgpsqqqd.onion |
| Leak location 1 | Web location | Up checked 3h ago | deadlock.liveblog365.com |
Top Activity Sectors (15)
- IT 16
- Manufacturing / Engineering 12
- Not identified 7
- Retail / E-commerce 7
- Finance / Legal / Insurance 6
- Transportation / Travel / Logistics 4
- NGOs / Associations 4
- Services 3
- Healthcare / Pharma 3
- Energy 3
- Construction / Real Estate 3
- Public Sector 2
- Education 2
- Telecommunications 2
- Hospitality / Food & Beverage / Tourism 1
Typical Attacks (9)
▼MITRE ATT&CK does not currently catalogue Deadlock, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v20.0. Confidence: medium. Treat it as orientation, not attribution.
-
T1059.003 Windows Command Shell Execution
What they do: Deadlock executes commands via cmd.exe
What that means: Adversaries may abuse the Windows command shell for execution.
-
What that means: Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence.
-
T1070.004 File Deletion Stealth
What that means: Adversaries may delete files left behind by the actions of their intrusion activity.
-
T1083 File and Directory Discovery Discovery
What that means: Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.
-
T1135 Network Share Discovery Discovery
What they do: Deadlock discovers network shares with net view
What that means: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.
-
T1021.002 SMB/Windows Admin Shares Lateral Movement
What they do: Deadlock moves laterally using SMB shares
What that means: Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).
-
T1486 Data Encrypted for Impact Impact
What they do: Deadlock encrypts files with custom ransomware
What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
-
T1489 Service Stop Impact
What they do: Deadlock stops services using net stop
What that means: Adversaries may stop or disable services on a system to render those services unavailable to legitimate users.
-
T1490 Inhibit System Recovery Impact
What they do: Deadlock inhibits recovery with vssadmin
What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.
Victims (125)
Search, filter and paginate the victim timeline for Deadlock. Showing 101–125 of 125.
| Type | Target | Discovered | Country | Business Category | Intel Link | Leak status |
|---|---|---|---|---|---|---|
| Ransomware | Bär Cargolift Polska Sp. z o.o. id30471 View details | Poland | Transportation / Travel / Logistics | pending | ||
|
Bär Cargolift specializing in the manufacturing of hydraulic tail lifts for vehicles, featuring products with capacities from 500 kg to 3,000 kg. The site offers an online WebShop for spare parts, technical support via Bär CargoCheck, and operator training, with a local headquarters in Gdańsk. |
||||||
| Ransomware | EXPRESOKNA SP. Z O.O. id30472 View details | Poland | Retail / E-commerce | pending | ||
|
EXPRESOKNA SP. Z O.O. a Polish manufacturer and distributor specializing in window and door systems. Based in Siemianowice Śląskie, the company is known for its exceptionally fast turnaround times for PVC and aluminum products. |
||||||
| Ransomware | TPToys id30473 View details | United Kingdom | Retail / E-commerce | pending | ||
|
TP Toys is a UK-based company that has specialized in designing and manufacturing high-quality children’s outdoor play equipment for over 60 years |
||||||
| Ransomware | IFC Eur id30474 View details | Germany | Education | pending | ||
|
IFC Europa is a Spanish-based distributor specializing in car audio, automotive lighting, and electronics. |
||||||
| Ransomware | Noega and Esnova id30475 View details | Spain | IT | pending | ||
|
Esnova (Esnova Racks S.A.) is a leading Spanish manufacturer specializing in industrial shelving and warehouse storage systems. Based in Gijón, Asturias, the company designs, manufactures, and installs solutions for logistics and warehouse management across more than 35 countries. Noega Systems is a specialized industrial company that designs, manufactures, and installs metal racking and storage solutions. Founded in 2010 and headquartered in Gijón, Spain, the firm provides end-to-end intralogistics services, including technical inspections (ITE) and automated warehouse planning. Over 130 gigabytes of internal data |
||||||
| Ransomware | iASK id30476 View details | Hungary | IT | pending | ||
|
The Institute of Advanced Studies Kőszeg is a Hungarian research center focusing on interdisciplinary studies, regional transformation in Central/Southeastern Europe, and sustainability. It operates as a hub for research, hosting an annual International Summer University and maintaining specialized collections at the Festetics Palace. |
||||||
| Ransomware | Finam Gabon id30477 View details | Gabon | Finance / Legal / Insurance | pending | ||
|
The leaked files will be available for download on May 15, 2026. Finam Gabon (Financière Africaine de Micro-projets) is a microfinance institution operating in Gabon since 2005, with over 150,000 clients. It provides a range of savings, loans and mobile banking services. |
||||||
| Ransomware | AFWorkshop id30478 View details | Singapore | Finance / Legal / Insurance | pending | ||
|
AFW an international architectural and design firm based in Singapore. Formerly known as Andy Fisher Workshop, the firm has been operating since 2004. They are a multi-disciplinary practice that works on a variety of large-scale and boutique projects across Asia and beyond. |
||||||
| Ransomware | NXIT and Franco Vago S.p.a. and Traconf Srl id30479 View details | Italy | Transportation / Travel / Logistics | pending | ||
|
The leaked files will be available for download on May 15, 2026. Nippon Express Italia SpA (NXIT) is the Italian division of the global NX Group (formerly Nippon Express). It was established on January 1, 2020, following a major merger involving several high-profile Italian logistics companies, including Franco Vago and Traconf . Recorded a consolidated turnover of almost EUR 1 billion in 2022. Core Services: The company specializes in integrated logistics and global freight forwarding, with a particularly strong reputation in the Fashion & Luxury sector. Traconf Srl a major Italian logistics firm specializing in fashion and luxury goods. Portuguese branch of Franco Vago , which, much like Traconf, is now a key part of the Nippon Express Italia SpA (NX Group) network. In Portugal, the company operates as a specialized freight forwarder with a strong focus on the textile, footwear, and luxury sectors—leveraging the historical expertise of the Franco Vago brand. Over 220 gigabytes of sensitive internal data were stolen from this company |
||||||
| Ransomware | bERS id30480 View details | Bulgaria | Energy | pending | ||
|
Bers logistics has been providing logistics services and high quality 3pl outsourcing of integrated logistics services. |
||||||
| Ransomware | Muzeum Valassko id30481 View details | Czechia | NGOs / Associations | pending | ||
|
Muzeum regionu Valašsko (The Museum of the Wallachian Region) is a multi-site cultural institution in the Zlín Region of the Czech Republic. |
||||||
| Ransomware | Breda Energia id30482 View details | Italy | Energy | pending | ||
|
Breda Energia S.p.A. is a global leader in the Oil & Gas industry, specializing in innovative products and services for onshore, offshore, and subsea applications. The company offers a wide range of solutions including wellheads, valves, high integrity pressure protection systems, and packaged systems, all designed with a focus on sustainability and cutting-edge technology. With over 60 years of experience, Breda Energia aims to be a partner to its clients, providing not just equipment but also qualified services to optimize performance and maintenance. Their commitment to quality is reflected in their adherence to various international standards and certifications. |
||||||
| Ransomware | EDISA and INVERTIGE id30483 View details | — | Other | pending | ||
|
Estudios de Investigación Servicio SL (also known commercially in some rankings as EDISA ) is a Limited liability company of a patrimonial and real estate nature with headquarters in Valencia, Spain.Although its corporate name includes the words "research studies", its real corporate purpose and main activities are focused on asset management, investment in other companies and real estate development. INVERTIGE SL is a Spanish company headquartered in ValenciaThe company is registered for central management functions and consultancy , with a focus on the administration and governance of other companies, and has an annual turnover of around EUR 1.9 million. |
||||||
| Ransomware | Direção Estacionamentos S.A. id30484 View details | Brazil | Transportation / Travel / Logistics | pending | ||
|
Autopark Estacionamentos is one of the largest and most reputable parking management companies in Brazil.Founded in Curitiba, Paraná , the company has over 36 years of experience in the market. |
||||||
| Ransomware | La ville de Ouangani id30485 View details | Mayotte | Other | pending | ||
|
French municipality of Ouangani on Mayotte |
||||||
| Ransomware | SECiL id30486 View details | Türkiye | IT | pending | ||
|
Seçil Kauçuk is a Turkish manufacturer, founded in 1983, specializing in rubber gaskets, sealing profiles, and industrial molded parts for sectors including construction, automotive, and infrastructure. Operating from a 70,000-square-meter facility in Tarsus, the company exports to over 50 countries and maintains an official R&D center for product testing. |
||||||
| Ransomware | CAD93 id30487 View details | Italy | IT | leaked | ||
|
C.A.D. 93 S.r.l. is a Prato-based firm of authorized customs brokers specializing in international trade, compliance, and import/export documentation. The agency provides comprehensive consulting services from its headquarters in Italy. |
||||||
| Ransomware | Fidelity Pension Managers id30488 View details | Nigeria | Finance / Legal / Insurance | pending | ||
|
Fidelity Pension Managers Limited regulated by PenCom in Nigeria, is a licensed Pension Fund Administrator (PFA) established in 2004 to manage retirement savings accounts (RSA). The company offers investment portfolio management and digital services, including the iPension portal and FidApp Plus, to facilitate RSA contributions. |
||||||
| Ransomware | Nobani Co id30489 View details | Iran, Islamic Republic of | Retail / E-commerce | pending | ||
|
Nobani & Co a professional financial services firm established in 1994. The company is headquartered in Amman, Jordan, and functions as an independent member of the Praxity international alliance of accounting and advisory firms. |
||||||
| Ransomware | CH Paper id30490 View details | China | Manufacturing / Engineering | pending | ||
|
Cheng Heng Paper Products Co (Pte) Ltd is a prominent regional manufacturer supplying corrugated cardboard boxes and custom packaging solutions. The company, with operations across Malaysia, Indonesia, and China, offers certified, durable products for logistics, e-commerce, and commercial retail. |
||||||
| Ransomware | donjon id30491 View details | Singapore | IT | pending | ||
|
Donjon Pte Ltd a trusted provider of mechanical and electrical (M&E) engineering services based in Singapore. Established in 2003, the company is a registered contractor with the Building and Construction Authority (BCA). They cater to commercial, industrial, and residential sectors. |
||||||
| Ransomware | TeleFinity id30492 View details | — | Telecommunications | pending | ||
|
TeleFinity is a global provider of computer telephony integration (CTI) and unified contact center software, offering solutions like LogFinity call recording, WebRTC-SIP gateways, and omnichannel contact center platforms. Founded in 2005, the company delivers enterprise-grade,, AI-driven, and CRM-integrated communication products with on-premises or cloud deployment options. |
||||||
| Ransomware | Hornavan Hotell id30493 View details | Sweden | Hospitality / Food & Beverage / Tourism | pending | ||
|
Hornavan Hotell is an independent 3-star property in Arjeplog, Swedish Lapland |
||||||
| Ransomware | Summa4 id30494 View details | Spain | IT | pending | ||
|
SUMMA 4 Asesores Legales y Tributarios is a Madrid-based firm specializing in legal and tax advisory for businesses and high-net-worth individuals. Established in 2008, the firm provides tailored strategies in tax, commercial, and labor law, with a particular focus on family businesses and family offices. |
||||||
| Ransomware | Zhangjiagang Fortune Chemical Co. Ltd. Singapore id30495 View details | Singapore | Manufacturing / Engineering | pending | ||
|
Zhangjiagang Fortune Chemical Co., Ltd. is a Chinese manufacturer established in 2013 that specializes in phosphorus esters, flame retardants, and functional fine chemicals. The company operates globally with over 25,000 tons of annual output and maintains full REACH compliance for international exports. |
||||||