Deadlock Ransomware Claims New Victim: UFOC

Executive Summary

Deadlock ransomware publicly claimed a new victim, UFOC, located in Taiwan. The group posted the stolen data on the ransomware.live leak site, confirming a successful exfiltration. The organization must immediately activate its incident response plan, assess the scope of encryption and data loss, and decide on regulatory disclosure.

Verified Facts

• Deadlock ransomware group claimed responsibility for the compromise of UFOC — article.
• The victim, UFOC, is based in Taiwan (TW) — article.
• The stolen data were published at https://www.ransomware.live/id/VUZPQ0BEZWFkbG9jaw== — article.

Threat Classification

Threat type: Ransomware (extortion‑focused) — HIGH CONFIDENCE. Affected sectors: Not disclosed (sector unknown) — MEDIUM CONFIDENCE. Geographic scope: Taiwan (origin of victim) with potential global impact via public leak — MEDIUM CONFIDENCE. Exploitation status: Active, as the group is currently publishing data — HIGH CONFIDENCE. Motivation: Financial extortion through data theft and ransom demand — HIGH CONFIDENCE.

Threat Severity Assessment

• Active exploitation and public data leak – HIGH CONFIDENCE.
• Potential encryption of critical systems – MEDIUM CONFIDENCE.
• Unknown sector impact limits immediate risk quantification – MEDIUM CONFIDENCE.

Business Impact

Operational disruption is imminent if UFOC’s systems are encrypted, leading to downtime of business‑critical services. The public leak of data may trigger regulatory investigation under Taiwan’s Personal Data Protection Act (PDPA) if personal data were exfiltrated, exposing the organization to fines and mandatory breach notifications. Reputational damage will arise from media coverage of the breach, potentially eroding customer trust and partner confidence.

Technical Analysis

The source article provides no technical details on the initial attack vector, exploitation chain, malware payload, or specific vulnerabilities leveraged by Deadlock.

MITRE ATT&CK Mapping

IOC Intelligence

No public IOCs other than the leak site were disclosed. Defenders should build hunt rules around the following behavioral indicators that are typical for Deadlock ransomware activity:

• Outbound HTTP/S connections to the domain ransomware.live or the specific URL path /id/VUZPQ0BEZWFkbG9jaw==.
• Creation of ransom note files (e.g., README_FOR_DECRYPT.txt) in user directories.
• Mass file encryption events characterized by a sudden surge in file write operations across multiple file extensions.
• Execution of PowerShell with the -EncodedCommand flag.

Detection Engineering Guidance

• Network proxy or firewall logs – monitor DNS queries and HTTP/S requests to ransomware.live; flag any successful connections.
• Sysmon Event ID 11 (FileCreate) – alert on creation of ransom note filenames or a high volume of file writes within a short time window.
• Windows Security Event ID 4688 – detect PowerShell processes launched with -EncodedCommand arguments.
• Endpoint AV/EDR telemetry – watch for processes that spawn child processes with suspicious command‑line arguments matching known ransomware patterns.

Sigma Rules

title: Outbound Connection to Known Deadlock Leak Site
id: 3f9c2d1e-5b6a-4f8a-9c2e-1a2b3c4d5e6f
status: stable
description: Detects HTTP/S requests to the ransomware.live leak URL used by Deadlock ransomware.
author: CYBERDUDEBIVASH Sentinel APEX
logsource:
    product: proxy
    service: http
detection:
    selection:
        DestinationDomain|contains: 'ransomware.live'
        URL|contains: '/id/VUZPQ0BEZWFkbG9jaw=='
    condition: selection
falsepositives:
    - Legitimate security research traffic
level: high
tags:
    - attack.command_and_control
    - attack.t1071.001

title: PowerShell Encoded Command Execution
id: a1b2c3d4-5678-90ab-cdef-1234567890ab
status: stable
description: Detects PowerShell processes launched with the -EncodedCommand flag, a technique observed in Deadlock ransomware campaigns.
author: CYBERDUDEBIVASH Sentinel APEX
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 1
        Image|endswith: '\\powershell.exe'
        CommandLine|contains: '-EncodedCommand'
    condition: selection
falsepositives:
    - Legitimate administrative scripts using encoded commands
level: high
tags:
    - attack.execution
    - attack.t1059.001

Threat Hunting Queries

• Hypothesis: Host made outbound connections to ransomware.live – Source: Proxy logs (field: dest_domain).
• Hypothesis: PowerShell executed with -EncodedCommand – Source: Sysmon Event ID 1 (fields: Image, CommandLine).
• Hypothesis: Sudden spike in file creation events across multiple extensions – Source: Sysmon Event ID 11 (field: TargetFilename).
• Hypothesis: Ransom note files named README_FOR_DECRYPT.txt appear in user profiles – Source: Sysmon Event ID 11 (field: TargetFilename).
• Hypothesis: DNS queries for ransomware.live – Source: DNS server logs (field:

🔗 Related Intelligence Reports

• Related topic: Helix Ransomware Claims New Victim: Delek US | Energy & Utilities Sector
• Related topic: krybit Ransomware Claims New Victim: sunsea.co.th | Other Sector
• Related topic: coinbasecartel Ransomware Claims New Victim: Advanced Engineering Consultants | Profession
• Related topic: coinbasecartel Ransomware Claims New Victim: Crowe | Professional Services Sector
• Related topic: qilin Ransomware Claims New Victim: Integraduanas