Threat reportRansomwareTL-2026-1809
DeadLock Ransomware Double-Extortion Attack on Diater (Spanish Biopharmaceutical Firm) Exposes Decade of Clinical/Pharmacovigilance Records
DeadLock Ransomware Double-Extortion Attack on Diater (TL-2026-1809) is a high-severity ransomware operation, first published 2026-08-01. It is attributed to DeadLock (Russia) with low confidence, affects DIATER (Laboratorio de Diagnóstico y Aplicaciones Terapéuticas, SA) /, maps to 29 MITRE ATT&CK techniques (T1003, T1003.001, T1006), and is covered by 9 detection rules and 30 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 29MITRE ATT&CK
- Actors
- 1DeadLock
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 30Indicators of compromise
Key facts for TL-2026-1809
- Threat ID
- TL-2026-1809
- Severity
- HIGH
- Status
- ACTIVE
- Category
- RANSOMWARE
- First published
- Last reviewed
- Attribution
- DeadLock
- Attribution confidence
- LOW
- Nation-state nexus
- Russia
- Motivation
- FINANCIAL
- Target sectors
- health, biopharmaceutical, pharmacy, manufacturing, professional services, construction and engineering
- Target regions
- spain, Europe, APAC, North America, 005 - South America, Middle East and Africa
- Detection rules
- 9
- Indicators of compromise
- 30
Malware and tooling in DeadLock Ransomware Double-Extortion Attack on Diater
Malware and tooling: DeadLock, 0x8EF7c3e531d871D3B9D559722DE77EB1dEc19dAe, 0xAc9f868E285C8141617a97b85b667f229147815c, AnyDesk, Mimikatz, PCHunter64, PSEXEC, SoftPerfect NetScan
How DeadLock Ransomware Double-Extortion Attack on Diater works
Spanish biopharmaceutical company DIATER (Laboratorio de Diagnóstico y Aplicaciones Terapéuticas, SA), a Madrid-based allergy-diagnostics and immunotherapy manufacturer owned by China's WORG Pharmaceuticals, was listed as a victim by the Russian-origin DeadLock ransomware group on 2026-07-28. DeadLock claims to have exfiltrated user-folder directories, QM documents, and EDICOM-linked material including clinical histories and pharmacovigilance records the company has retained for roughly a decade. No ransom amount, precise intrusion date, or definitive data inventory has been publicly disclosed.
On 2026-07-28 at 14:51 UTC, the DeadLock ransomware group's leak site listed DIATER (Laboratorio de Diagnóstico y Aplicaciones Terapéuticas, SA) as a victim of a double-extortion attack. DIATER is a Madrid-headquartered biopharmaceutical company founded in 1999 specializing in molecular allergy diagnostics and allergen-specific immunotherapy (ASIT); since 2023 it has operated as part of Chinese biopharmaceutical group WORG Pharmaceuticals (Zhejiang) Co., Ltd., which runs an integrated R&D/production subsidiary spanning Shanghai and Madrid, and DIATER's products are marketed through Allergen Servilab (Spain) and Diater Laboratorios (Spain, Portugal, Germany). Public reporting (DataBreaches.net, mirrored by APD Noticias) states DeadLock claims to have exfiltrated user-folder directories, general documents, Quality Management (QM) files, and material tied to DIATER's EDICOM electronic-document/EDI integration, including clinical histories and pharmacovigilance data the company has been required to retain for approximately ten years. Because DIATER handles allergy diagnostics and immunotherapy products used directly on patients, the exposed record set plausibly includes sensitive personal health data of patients and healthcare professionals, raising GDPR Article 9 (special-category data) exposure concerns. No ransom demand figure, confirmed initial-intrusion date, or itemized data inventory has been made public as of this writing.
DeadLock is a financially motivated, non-nation-state-affiliated ransomware operation first observed by researchers in mid-2025. It differentiates itself technically by using Polygon blockchain smart contracts (primary contract 0x8EF7c3e531d871D3B9D559722DE77EB1dEc19dAe, secondary 0xAc9f868E285C8141617a97b85b667f229147815c) to rotate proxy-server addresses via cost-free read-only eth_call methods, and by pairing this with kernel-level EDR-termination capability (BYOVD — bring-your-own-vulnerable-driver) and Session-messenger-based victim negotiation. Victim files are appended with a `.dlock` extension plus a short per-victim identifier (e.g., `report.pdf.A1B2C3.dlock`), and the encryptor drops `HOW_RECOVER.<ID>.txt` and `RECOVERY_CHAT.<ID>.html` ransom-note/negotiation artifacts plus a custom `.ico` file, changing the desktop wallpaper to reinforce the extortion message; payment is demanded in Bitcoin or Monero. The malware performs a language/locale check and refuses to execute on Cyrillic-configured systems, a common self-preservation behavior among CIS-region-linked ransomware crews, consistent with the 'Russian-origin' attribution used in initial triage, though public threat-intel reporting characterizes DeadLock as an independent criminal enterprise without confirmed nation-state sponsorship (attribution confidence: LOW-to-MEDIUM, circumstantial).
Across its broader campaign, DeadLock resurfaced in June 2026 after roughly eleven months of relative public silence, posting 75 new victims that month and entering leak-site leaderboards in second place; by 2026-06-16 its clearnet leak site (deadlock.liveblog365[.]com) listed approximately 80 victims, roughly 57% concentrated in the Europe/Russia region with the remainder spread across APAC, North America, South America, and the Middle East/Africa, and with Manufacturing as the most frequently hit sector alongside Construction & Engineering and Professional Services. Documented DeadLock intrusion tradecraft (aggregated across public reporting, not confirmed victim-specific for DIATER) spans initial access via compromised domain/local accounts and external remote services (sometimes staged through compromised WordPress sites), Windows-native execution (PowerShell, cmd, WMI), service-based persistence, BYOVD privilege escalation and kernel-level EDR/security-tool impairment, LSASS credential dumping (Mimikatz), internal reconnaissance (SoftPerfect NetScan, PCHunter64), lateral movement via RDP and SMB admin shares, staged collection from network shares, AnyDesk-based remote-access C2, exfiltration ahead of encryption, and impact via file encryption, Volume Shadow Copy deletion, and security/backup service termination. Diater/WORG's ransomware.live infrastructure profile additionally shows evidence of pre-ransomware infostealer-driven credential compromise (Hudson Rock telemetry) against at least one DIATER-linked user and a third-party/vendor credential, which is consistent with valid-account-based initial access as the likely intrusion vector, though this remains unconfirmed for this specific incident.
Assessment gap: no CVE, malware sample, or IOC set has been published specifically tied to the DIATER intrusion; all technical indicators below are drawn from DeadLock's documented tooling/infrastructure across its broader 2025-2026 campaign and should be treated as hunting leads rather than confirmed artifacts from this incident. BeaconBeagle C2 correlation lookups against DeadLock's known proxy IPs (138.226.236.51, 94.74.164.207) returned no additional beacon matches at time of research.
MITRE ATT&CK techniques used in TL-2026-1809
Credential Access
T1003 OS Credential Dumping; T1003.001 LSASS Memory
Defense Evasion
T1006 Direct Volume Access; T1027 Obfuscated Files or Information; T1070.004 File Deletion; T1211 Exploitation for Stealth; T1622 Debugger Evasion
Discovery
T1018 Remote System Discovery; T1082 System Information Discovery
Lateral Movement
T1021.001 Remote Desktop Protocol; T1021.002 SMB/Windows Admin Shares
Collection
T1039 Data from Network Shared Drive
Exfiltration
T1041 Exfiltration Over C2 Channel
Execution
T1047 Windows Management Instrumentation; T1059.001 PowerShell; T1059.003 Windows Command Shell
Privilege Escalation
T1055 Process Injection; T1068 Exploitation for Privilege Escalation
Command and Control
T1071.001 Web Protocols; T1102.002 Bidirectional Communication; T1219 Remote Access Tools
Initial Access
T1078.002 Domain Accounts; T1078.003 Local Accounts; T1133 External Remote Services
Impact
T1486 Data Encrypted for Impact; T1489 Service Stop; T1490 Inhibit System Recovery
Persistence
defense-impairment
Affected products and versions in DeadLock Ransomware Double-Extortion Attack on Diater
- DIATER (Laboratorio de Diagnóstico y Aplicaciones Terapéuticas, SA) / WORG Pharmaceuticals — Corporate IT environment, user-folder file shares, Quality Management (QM) document systems, and EDICOM-linked clinical history / pharmacovigilance record systems
Vulnerable versions: Not a software-version vulnerability — data breach of production IT environment
Remediation for DeadLock Ransomware Double-Extortion Attack on Diater
Immediate actions
- Isolate and forensically image affected DIATER systems before further remediation to preserve evidence
- Rotate all credentials for domain and local accounts, especially any tied to third-party/vendor access such as the EDICOM integration
- Hunt across the environment for .dlock-extension files, HOW_RECOVER.<ID>.txt and RECOVERY_CHAT.<ID>.html artifacts
- Block outbound connections to known DeadLock proxy infrastructure (138.226.236.51, 94.74.164.207, biggoalsports.co.za, nmsneustadtl.ac.at, envisionreg.com) and the deadlock.liveblog365[.]com leak site
- Audit and disable unauthorized AnyDesk or other remote-access tool installations
Workarounds
- Restrict or disable SMB/RDP administrative shares between workstation and server network segments pending a full lateral-movement audit
- Enforce perimeter-level blocking of Session messenger protocol traffic and unmanaged remote-access software
Longer-term hardening
- Deploy phishing-resistant MFA and Zero-Trust access controls on all remote-access and third-party/vendor connections
- Implement kernel-mode driver allow-listing (e.g., Microsoft WDAC) to block BYOVD privilege-escalation and EDR-killer drivers
- Segment clinical/pharmacovigilance data stores from the general corporate network to limit lateral-movement blast radius
- Establish offline, immutable backups for clinical-records systems with regular restoration testing
- Integrate DeadLock TTP-based threat intelligence (Session-messenger C2, Polygon smart-contract proxy rotation, BYOVD drivers) into detection engineering and threat hunting
Timeline of DeadLock Ransomware Double-Extortion Attack on Diater
- DIATER Pharmaceutical Laboratory officially becomes a wholly owned subsidiary of Chinese biopharmaceutical group WORG Pharmaceuticals (Zhejiang) Co., Ltd. in October 2023, integrating DIATER's Madrid IT/data environment with WORG's Shanghai-Madrid R&D/production structure.
- Earliest known DeadLock encryptor sample identified (creation timestamp 2025-06-27 15:45:06 UTC; SHA-256 3c1b9df801b9abbb3684670822f367b5b8cda566b749f457821b6481606995b3); ransom note at this stage makes no mention of data theft, encryption-only extortion. Group-IB dates DeadLock's official discovery to July 2025.
- Revised DeadLock encryptor sample (SHA-256 3cd5703d285ed2753434f14f8da933010ecfdc1e5009d0e438188aaf85501612) and an accompanying PowerShell defense-evasion script are compiled the same day; the updated ransom note begins explicitly threatening published stolen data alongside encryption, confirming a shift to double extortion.
- The double-extortion-variant encryptor sample is submitted to a public malware-analysis platform from Spain, one of the earliest indications of DeadLock sample activity/analysis tied to the Spanish threat landscape later realized in the DIATER incident a year later.
- DeadLock's operator wallet (0x8f2fef1339E0d90362F3cEAd9C27B661d964a022), funded via the Fixed Float exchange, deploys the primary and secondary Polygon blockchain smart contracts later used for cost-free, read-only proxy-address rotation; deployment aligns with the most recently observed encryptor sample at that time.
- Third DeadLock ransom-note/encryptor variant (SHA-256 c9cc95ff8f2998229394dfd31c2bd6b723e826a3ca5e008d2b5be19ba419ae2c) expands extortion threats to include selling stolen data, publishing security reports on the victim, and a 'guarantee not to attack again' clause.
- First DeadLock proxy-server addresses are registered into the Polygon smart contract, operationalizing the blockchain-based C2 proxy-rotation infrastructure.
- Most recent DeadLock proxy-server address update recorded in the Polygon smart contract as of Group-IB's research cutoff, indicating the infrastructure remained actively maintained into Q4 2025.
- Group-IB publishes technical research ('DeadLock Ransomware: Smart Contracts for Malicious Purposes') detailing the group's use of Polygon smart contracts for proxy-server address rotation.
- ZeroFox observes DeadLock's clearnet leak site (deadlock.liveblog365[.]com) listing approximately 80 named victims, with the group re-emerging publicly after roughly 11 months of relative silence and posting 75 new victims that month, moving into second place on ransomware leaderboards.
- SOCRadar threat-intel reporting cutoff on DeadLock notes ~57% of the group's ~80 claimed victims are concentrated in the Europe/Russia region, with Manufacturing the most frequently targeted sector.
- ZeroFox publishes its flash report on DeadLock's leak site surpassing 80 listed victims, formalizing the June 16 observation and June 25 intelligence cutoff into a public advisory.
- DeadLock's leak site lists DIATER (Laboratorio de Diagnóstico y Aplicaciones Terapéuticas, SA, Madrid) as a victim at 14:51 UTC; ransomware.live records this as both the discovery date and estimated attack date.
- DataBreaches.net (mirrored by APD Noticias) publicly reports the DIATER breach, detailing DeadLock's claims of exfiltrated user-folder directories, QM documents, and EDICOM-linked clinical history and pharmacovigilance data retained for roughly a decade.
Sources cited for DeadLock Ransomware Double-Extortion Attack on Diater
- The double extortion of a Russian ransomware threatens the medical records that Diater has kept for 10 years
- Victim: DIATER – Deadlock
- DeadLock Ransomware: Smart Contracts for Malicious Purposes
- deadlock Ransomware Group Profile
- DeadLock Ransomware Analysis (MITRE ATT&CK mapping and detection content)
- Deadlock Ransomware: Current Assessment and Defender Guidance
- Flash Report: DeadLock's Ransomware Leak Site Lists over 80 Victims
- Company | DIATER International
- Diater Pharmaceutical Laboratory - Worg Pharmaceuticals (Zhejiang) Co., Ltd.
Detection coverage for TL-2026-1809
As of 2026-08-01, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1809 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-1809
1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.