DeadLock Ransomware Shows Why a Backup Is Not a Recovery Plan
The newest ransomware tradecraft targets the services, identities, and dependencies organizations need to restore operations. Sponsored by Gambit Security.
Resilience That Never Expires. Recovery You Can Prove.
The AI-native platform that validates whether your entire stack actually recovers.
Microsoft Threat Intelligence disclosed DeadLock ransomware on August 10, 2026. The Rust-based encryptor does more than lock files. Before encryption, it attempts to remove the recovery options defenders may depend on during an incident.
Microsoft found DeadLock configured to stop or disable Windows services tied to Volume Shadow Copy, Windows Backup, Hyper-V, Active Directory, and security tooling. It also targets processes used for cloud sync, backup, remote access, and administration. The malware empties the recycle bin and clears or disables event logs, reducing both recovery options and evidence.
This behavior is not unusual in its objective. Ransomware operators know that the ability to recover changes the economics of extortion. What makes DeadLock timely is how clearly it shows the gap between having copies of data and restoring a working service. A database backup can survive while the identity, network route, encryption key, configuration, or compute layer needed to use it does not.
What does DeadLock target before encryption?
DeadLock prepares the environment so encryption has a wider effect and defenders have fewer ways back. Its configuration includes process and service stop lists. Microsoft observed targets across several recovery-critical areas:
- Volume Shadow Copy and Windows Backup services, which may provide local restore paths.
- Hyper-V services, which support virtual workloads that may host several business systems.
- Active Directory services, which applications and administrators rely on for authentication and control.
- Cloud-sync clients and backup processes, which can hold copies or move data between systems.
- Security and logging services, which defenders need to detect activity and reconstruct the incident.
The attack also enables powerful privileges when it runs with administrator rights, including backup, restore, debug, ownership, and security privileges. Those permissions help it reach protected files and interfere with controls. The result is an attack aimed at the operating environment, not one folder in isolation. This targeting of identity infrastructure mirrors a trend Decryption Digest has tracked closely: AI-generated malware was recently caught mapping Active Directory environments in a live attack, automating reconnaissance that once took human operators hours to complete.
“Ransomware recovery fails at the weakest dependency. A clean data copy is valuable, but it cannot restore a service when its keys, identity, network, routing, or infrastructure definition is missing or compromised.”
Practitioner Lesson
Why does recovery fail even when backups exist?
Backup systems answer a narrow and essential question: is a copy of the data available for restore? Business recovery asks a wider question: can the service return within its recovery objective and function safely for users?
A modern application is a dependency graph. It may rely on compute, databases, storage, identities, encryption keys, DNS, private endpoints, load balancers, secrets, and queues. Many of these resources and relationships may be defined in infrastructure as code, which helps teams rebuild the environment in the correct state and order.
Several failure modes appear often in cloud recovery planning:
- A database restores, but its customer-managed encryption key is unavailable.
- Servers return, but private endpoints or DNS records do not route traffic to them.
- A virtual machine is rebuilt, but a system-assigned identity disappeared with the original instance.
- Data returns, but the infrastructure-as-code template reflects an old size or configuration and cannot host it.
- Replicated data is present in another region, but corruption or encryption was copied there too.
These are not backup failures. The copy may be intact. They are application recovery failures caused by missing context, broken dependencies, or an incorrect recovery order. The larger issue is a recovery plan built for passive infrastructure failure rather than an active adversary. Ransomware does not target data alone. Attackers may compromise identities, alter cloud configurations, disable security tools, damage virtualization systems, delete backups, and disrupt the network and control-plane services applications need. They may coordinate these actions to make recovery slower, less certain, and more costly. Signature Healthcare's Anubis ransomware breach is a case study in what recovery failure costs in practice: 2TB stolen, chemotherapy canceled, and emergency care diverted while the hospital worked to restore operations.
Briefings like this, every morning before 9am.
Threat intel, active CVEs, and campaign alerts, distilled for practitioners. 50,000+ subscribers. No noise.
What changed in the ransomware threat model?
Traditional disaster recovery often starts with a failed server, storage system, or region. Ransomware begins with an attacker who can steal credentials, change configuration, disable services, destroy control-plane resources, and target backups before deploying the encryptor.
Google Threat Intelligence reported that ransomware actors targeted virtualization infrastructure in about 43 percent of the 2025 intrusions it analyzed, up from 29 percent in 2024. Google also observed credential harvesting from backup platforms and privileged account abuse that could support destructive actions across the environment. That trend lines up with VMware vCenter CVE-2026-59310, where 361 servers across 47 countries were breached this month alone, underscoring how virtualization infrastructure has become one of ransomware operators' preferred entry points into recovery-critical systems.
Sophos reported that 56 percent of surveyed ransomware attacks in its 2026 study succeeded in encrypting data, with an average recovery cost of $1.7 million. Its guidance calls for tested backups as part of a layered plan. The word tested matters. A successful backup job proves that data was copied. It does not prove that a business application will return cleanly, in the right order, with its dependencies intact.
How should teams prove application recovery?
A recovery program needs evidence at the business-application level. Practitioners should begin with the service the organization must restore, then work backward through everything required to make it usable.
Subscribe to unlock Remediation & Mitigation steps
Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.
Where does Gambit Security fit?
This is the point where the recovery problem becomes too broad and dynamic for a spreadsheet. Gambit Security built Balens to map enterprise resources into business applications and evaluate whether those applications can recover across cloud, backup, infrastructure-as-code, and security tooling.
According to Gambit, Balens connects through agentless, read-only, metadata-only access. It discovers resources and correlates signals such as tags, naming, infrastructure relationships, and flow data into application maps. The goal is to represent the payment service or customer portal, not only a list of databases, virtual machines, and storage accounts.
Balens then evaluates the application across infrastructure failure, human and AI error, and cyberattack scenarios. It checks issues such as missing backup coverage, weak immutability, policy gaps, infrastructure drift, and dependencies that would block recovery. Findings feed an application-level Resilience Score and prioritized remediation guidance.
The platform is designed for large organizations with complex cloud estates, multiple backup systems, incomplete infrastructure-as-code coverage, and business applications that cross team or tool boundaries. The likely users include security and resilience leaders, cloud infrastructure teams, disaster recovery and business continuity owners, backup teams, and governance groups that must show evidence to boards, regulators, insurers, or customers.
Resilience That Never Expires. Recovery You Can Prove.
The AI-native platform that validates whether your entire stack actually recovers.
What should practitioners ask before approving a recovery claim?
- Does the recovery scope include the complete business application, not only its data stores?
- Can the plan restore identity, encryption keys, private networking, DNS, routing, and application configuration?
- Are backup copies truly immutable against an administrator or compromised control-plane identity?
- Does the recovery definition match the live environment, including out-of-band changes and infrastructure drift?
- Can the team identify a clean restore point rather than only the newest available copy?
- Has the organization tested an adversarial scenario where replication may spread corruption?
- Can the team show evidence that the application meets its RTO and RPO after the full dependency chain returns?
The bottom line
DeadLock is a useful warning because its preparation phase targets services that support defense, evidence, virtualization, identity, backup, and recovery. The encryptor is only the visible end of the incident. By that point, the attacker may have already weakened the systems needed to bring the business back.
Backups remain essential. They are not the same as a working application. Recovery requires data, infrastructure, identity, networking, configuration, and clean restore points to return together. Teams should test that outcome continuously because cloud environments and application dependencies change faster than quarterly recovery plans.
Gambit Security positions Balens around that proof. It maps the live estate into business applications, checks resilience gaps across the stack, and gives teams evidence and remediation steps before disruption. The desired outcome is simple: know which applications can recover, which cannot, and what to fix first.
Frequently asked questions
What is the difference between restore and recovery?
Restore returns a protected resource or data copy. Recovery returns a complete business service, including the identity, networking, keys, configuration, infrastructure, and dependencies required for it to function.
Why are immutable backups not enough?
Immutability protects a backup from alteration or deletion. It does not recreate missing application dependencies, correct infrastructure drift, restore identities, or prove that the application meets its recovery objective.
What does DeadLock teach recovery teams?
DeadLock targets backup, shadow copy, virtualization, identity, security, and logging services before encryption. Recovery planning must assume an active attacker will interfere with the tools and control planes defenders need.
How is Balens different from a backup platform?
Backup platforms protect and restore data or workloads. Balens reads across backup, cloud, infrastructure-as-code, and security systems to validate whether the full application dependency graph can recover. Gambit positions it as complementary to existing backup tools.
Who is the ideal customer for Balens?
Balens is aimed at enterprises with complex cloud or hybrid estates, many business applications, multiple recovery tools, and a need to prove resilience to operational leaders, boards, regulators, insurers, or customers.
Sources & references
Free resources
Critical CVE Reference Card 2025–2026
25 actively exploited vulnerabilities with CVSS scores, exploit status, and patch availability. Print it, pin it, share it with your SOC team.
Ransomware Incident Response Playbook
Step-by-step 24-hour IR checklist covering detection, containment, eradication, and recovery. Built for SOC teams, IR leads, and CISOs.
Get threat intel before your inbox does.
50,000+ security professionals read Decryption Digest for early warnings on zero-days, ransomware, and nation-state campaigns. Free, daily, no spam.
Unsubscribe anytime. We never sell your data.
Founder & Cybersecurity Evangelist, Decryption Digest
Cybersecurity professional with expertise in threat intelligence, vulnerability research, and enterprise security. Covers zero-days, ransomware, and nation-state operations for 50,000+ security professionals every morning.