# DeadLock Ransomware Double-Extortion Attack on Diater (Spanish Biopharmaceutical Firm) Exposes Decade of Clinical/Pharmacovigilance Records

> Spanish biopharmaceutical company DIATER (Laboratorio de Diagnóstico y Aplicaciones Terapéuticas, SA), a Madrid-based allergy-diagnostics and immunotherapy manufacturer owned by China's WORG Pharmaceuticals, was listed as a victim by the Russian-origin DeadLock ransomware group on 2026-07-28. DeadLock claims to have exfiltrated user-folder directories, QM documents, and EDICOM-linked material including clinical histories and pharmacovigilance records the company has retained for roughly a decade. No ransom amount, precise intrusion date, or definitive data inventory has been publicly disclosed.

- **Published:** 2026-08-01T00:00:00Z
- **Last reviewed:** 2026-08-01T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1809
- **ID:** TL-2026-1809
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** DeadLock (Russia)
- **Detections:** 9 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 2026-07-28 at 14:51 UTC, the DeadLock ransomware group's leak site listed DIATER (Laboratorio de Diagnóstico y Aplicaciones Terapéuticas, SA) as a victim of a double-extortion attack. DIATER is a Madrid-headquartered biopharmaceutical company founded in 1999 specializing in molecular allergy diagnostics and allergen-specific immunotherapy (ASIT); since 2023 it has operated as part of Chinese biopharmaceutical group WORG Pharmaceuticals (Zhejiang) Co., Ltd., which runs an integrated R&D/production subsidiary spanning Shanghai and Madrid, and DIATER's products are marketed through Allergen Servilab (Spain) and Diater Laboratorios (Spain, Portugal, Germany). Public reporting (DataBreaches.net, mirrored by APD Noticias) states DeadLock claims to have exfiltrated user-folder directories, general documents, Quality Management (QM) files, and material tied to DIATER's EDICOM electronic-document/EDI integration, including clinical histories and pharmacovigilance data the company has been required to retain for approximately ten years. Because DIATER handles allergy diagnostics and immunotherapy products used directly on patients, the exposed record set plausibly includes sensitive personal health data of patients and healthcare professionals, raising GDPR Article 9 (special-category data) exposure concerns. No ransom demand figure, confirmed initial-intrusion date, or itemized data inventory has been made public as of this writing.

DeadLock is a financially motivated, non-nation-state-affiliated ransomware operation first observed by researchers in mid-2025. It differentiates itself technically by using Polygon blockchain smart contracts (primary contract 0x8EF7c3e531d871D3B9D559722DE77EB1dEc19dAe, secondary 0xAc9f868E285C8141617a97b85b667f229147815c) to rotate proxy-server addresses via cost-free read-only eth_call methods, and by pairing this with kernel-level EDR-termination capability (BYOVD — bring-your-own-vulnerable-driver) and Session-messenger-based victim negotiation. Victim files are appended with a `.dlock` extension plus a short per-victim identifier (e.g., `report.pdf.A1B2C3.dlock`), and the encryptor drops `HOW_RECOVER.<ID>.txt` and `RECOVERY_CHAT.<ID>.html` ransom-note/negotiation artifacts plus a custom `.ico` file, changing the desktop wallpaper to reinforce the extortion message; payment is demanded in Bitcoin or Monero. The malware performs a language/locale check and refuses to execute on Cyrillic-configured systems, a common self-preservation behavior among CIS-region-linked ransomware crews, consistent with the 'Russian-origin' attribution used in initial triage, though public threat-intel reporting characterizes DeadLock as an independent criminal enterprise without confirmed nation-state sponsorship (attribution confidence: LOW-to-MEDIUM, circumstantial).

Across its broader campaign, DeadLock resurfaced in June 2026 after roughly eleven months of relative public silence, posting 75 new victims that month and entering leak-site leaderboards in second place; by 2026-06-16 its clearnet leak site (deadlock.liveblog365[.]com) listed approximately 80 victims, roughly 57% concentrated in the Europe/Russia region with the remainder spread across APAC, North America, South America, and the Middle East/Africa, and with Manufacturing as the most frequently hit sector alongside Construction & Engineering and Professional Services. Documented DeadLock intrusion tradecraft (aggregated across public reporting, not confirmed victim-specific for DIATER) spans initial access via compromised domain/local accounts and external remote services (sometimes staged through compromised WordPress sites), Windows-native execution (PowerShell, cmd, WMI), service-based persistence, BYOVD privilege escalation and kernel-level EDR/security-tool impairment, LSASS credential dumping (Mimikatz), internal reconnaissance (SoftPerfect NetScan, PCHunter64), lateral movement via RDP and SMB admin shares, staged collection from network shares, AnyDesk-based remote-access C2, exfiltration ahead of encryption, and impact via file encryption, Volume Shadow Copy deletion, and security/backup service termination. Diater/WORG's ransomware.live infrastructure profile additionally shows evidence of pre-ransomware infostealer-driven credential compromise (Hudson Rock telemetry) against at least one DIATER-linked user and a third-party/vendor credential, which is consistent with valid-account-based initial access as the likely intrusion vector, though this remains unconfirmed for this specific incident.

Assessment gap: no CVE, malware sample, or IOC set has been published specifically tied to the DIATER intrusion; all technical indicators below are drawn from DeadLock's documented tooling/infrastructure across its broader 2025-2026 campaign and should be treated as hunting leads rather than confirmed artifacts from this incident. BeaconBeagle C2 correlation lookups against DeadLock's known proxy IPs (138.226.236.51, 94.74.164.207) returned no additional beacon matches at time of research.

## MITRE ATT&CK

- T1078.002 Domain Accounts
- T1078.003 Local Accounts
- T1133 External Remote Services
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1047 Windows Management Instrumentation
- T1543.003 Windows Service
- T1068 Exploitation for Privilege Escalation
- T1055 Process Injection
- T1211 Exploitation for Stealth
- T1685 Disable or Modify Tools
- T1070.004 File Deletion
- T1006 Direct Volume Access
- T1622 Debugger Evasion
- T1027 Obfuscated Files or Information
- T1003 OS Credential Dumping
- T1003.001 LSASS Memory
- T1018 Remote System Discovery
- T1082 System Information Discovery
- T1021.001 Remote Desktop Protocol
- T1021.002 SMB/Windows Admin Shares
- T1039 Data from Network Shared Drive
- T1102.002 Bidirectional Communication
- T1071.001 Web Protocols
- T1219 Remote Access Tools
- T1041 Exfiltration Over C2 Channel
- T1486 Data Encrypted for Impact
- T1489 Service Stop
- T1490 Inhibit System Recovery

## Sources

- [The double extortion of a Russian ransomware threatens the medical records that Diater has kept for 10 years](https://www.apdnoticies.com/en/data-protection/the-double-extortion-of-a-russian-ransomware-threatens-the-medical-records-that-diater-has-kept-for-10-years_21644_102.html)
- [Victim: DIATER – Deadlock](https://www.ransomware.live/id/RElBVEVSQERlYWRsb2Nr)
- [DeadLock Ransomware: Smart Contracts for Malicious Purposes](https://www.group-ib.com/blog/deadlock-ransomware-polygon-smart-contracts/)
- [deadlock Ransomware Group Profile](https://socradar.io/free-tools/ransomware-intelligence/groups/deadlock)
- [DeadLock Ransomware Analysis (MITRE ATT&CK mapping and detection content)](https://socprime.com/active-threats/deadlock-ransomware-analysis/)
- [Deadlock Ransomware: Current Assessment and Defender Guidance](https://threatscene.com/blog-update/deadlock-ransomware-current-assessment-and-defender-guidance/)
- [Flash Report: DeadLock's Ransomware Leak Site Lists over 80 Victims](https://www.zerofox.com/intelligence/flash-report-deadlocks-ransomware-leak-site-lists-over-80-victims/)
- [Company | DIATER International](https://www.diater.com/en/company)
- [Diater Pharmaceutical Laboratory - Worg Pharmaceuticals (Zhejiang) Co., Ltd.](https://www.worgpharma.com/en/diater.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1809