← threat actors
threat actor · not yet in the cluster map
deadlock
also tracked as krybit 1, prinz eugen 1
5 stories · 4 in the wild · June 19, 2026 – July 13, 2026
evidence: 4 observed
sectors
- manufacturing 1 · Jul 13
- energy 1 · Jul 11
- transport 1 · Jul 11
geography
- indonesia 1 · Jul 13
- finland 1 · Jul 11
- sweden 1 · Jul 11
malware and tools
- deadlock 2 · Jul 13
- babuk 1 · Jun 21
- krybit 1 · Jun 21
- prinz eugen 1 · Jun 21
techniques
- ransomware 1 · Jul 11
- exfiltration 1 · Jun 21
attack phases seen
- Impact 3 · Jul 13
- Exfiltration 1 · Jun 21
what we reported, newest first, grouped by story
Jul 11 – July 13, 2026 · 2 reports
- DeadLock ransomware is running at a high operational tempo, publishing 10+ new victims in a matter of days including Indonesian plastics maker Vinilon Group (FalconFeeds, DarkFeed).
· Jul 13 · observed · Threat Activity
- DeadLock ransomware posted 11 new victims in a single burst, including Finland's Enedo Power and Sweden's Carrier Transport AB, signaling a high operational tempo worth monitoring. FalconFeeds
· Jul 11 · observed · Threat Intelligence
Jun 17 – June 21, 2026 · 3 reports
- DeadLock is expanding its abuse of Polygon blockchain smart contracts — moving beyond chat-proxy rotation to host its data-leak site entirely on-chain (75 victims since February), with HTML ransom notes fetching victim data live from the contract (ESET). Nextron flagged KRYBIT, a new double-extortion strain whose YARA profile overlaps heavily with the leaked Babuk codebase (Nextron), and Prinz Eugen emerged prioritizing recently-modified files for faster encryption while leaving no ransom note (BleepingComputer).
· Jun 21 · observed · as krybit, prinz eugen · Ransomware & EDR Evasion
- DeadLock is expanding its use of Polygon smart contracts — now hosting its leak-site entries on-chain (75 victims since February) in addition to chat-proxy rotation, with notes fetching victim data live from the contracts. ESET
· Jun 20 · none · Ransomware & Extortion
- DeadLock now hosts its data-leak site on Polygon smart contracts — a first ESET is aware of — combining on-chain DLS resilience with a clearweb mirror and interactive HTML ransom notes (ESET).
· Jun 19 · observed · Ransomware