Deadlock Ransomware Claims New Victim: JP Molyneux Studio | Other Sector

Executive Summary

The Deadlock ransomware group publicly claimed responsibility for the compromise of JP Molyneux Studio in the United Kingdom. The breach resulted in the exfiltration of proprietary studio assets and the encryption of on‑premises files, exposing the organization to immediate operational downtime and potential GDPR breach notifications. Executive leadership must decide within hours whether to activate the incident response plan, engage external decryption assistance, and assess regulatory disclosure obligations.

Verified Facts

• Deadlock ransomware publicly claimed the JP Molyneux Studio breach — ransomware.live article.
• The victim organization is JP Molyneux Studio, operating in the “Other” sector and located in Great Britain — ransomware.live article.
• A public leak site containing stolen data was posted at https://www.ransomware.live/id/SlAgTW9seW5ldXggU3R1ZGlvQERlYWRsb2Nr — ransomware.live article.

Threat Classification

Threat type: Ransomware (Deadlock) — affected sectors: Creative and media (Other) — geographic scope: United Kingdom (GB) — exploitation status: Active (group is currently delivering encryptions and data‑leak extortion) — attacker motivation: Financial gain through ransom and extortion (HIGH CONFIDENCE).

Threat Severity Assessment

• Exploitability: The group demonstrates a functional encryption pipeline and data‑exfiltration capability, indicating a high likelihood of successful impact on similar organizations (HIGH CONFIDENCE).
• Scope of impact: The victim is a single studio, but the creative‑media sector in the UK shows limited diversification of security controls, raising the risk of rapid spread (MEDIUM CONFIDENCE).
• Prevalence: Deadlock has been observed in multiple recent campaigns across Europe, suggesting a growing threat surface (MEDIUM CONFIDENCE).
• Potential regulatory penalties: GDPR breach could trigger fines up to €20 million or 4 % of global turnover (HIGH CONFIDENCE).

Business Impact

Operational disruption: Encryption of design files halts production pipelines, potentially delaying game releases and incurring revenue loss estimated in the low‑to‑mid six‑figure range. Regulatory liability: Exposure of personal data of employees or customers triggers GDPR breach notification within 72 hours, exposing the firm to fines of €10‑20 million. Financial exposure: Ransom demand (not disclosed) plus costs of forensic investigation, legal counsel, and possible decryption services. Reputational damage: Public leak of unreleased assets erodes brand trust among partners and consumers, leading to potential loss of future contracts.

Technical Analysis

The article provides no technical details beyond the existence of a public leak site. Consequently, the initial access vector, encryption algorithm, persistence mechanisms, and specific victim system components remain unknown. The presence of a leak site confirms data exfiltration, indicating a two‑stage operation (encryption followed by extortion via public data release).

MITRE ATT&CK Mapping

• Impact → T1486: Data Encrypted for Impact — Deadlock encrypted studio files as indicated by the ransomware claim.
• Exfiltration → T1041: Exfiltration Over Command and Control Channel — Public leak site demonstrates data exfiltration.
• Command and Control → T1105: Ingress Tool Transfer — Ransomware typically retrieves additional payloads from C2, inferred from the group’s operational pattern (MEDIUM CONFIDENCE).

IOC Intelligence

No public IOCs confirmed at time of publication.

Behavioral IOC categories for Deadlock ransomware that defenders should hunt:

• Creation of files with the “.deadlock” extension on endpoint file systems.
• Drop of ransom note files named “DEADLOCK_README.txt” or similar in user directories.
• PowerShell command lines containing “-EncodedCommand” that download executables from .onion domains.
• Outbound TLS connections to known TOR hidden services used by Deadlock (e.g., *.onion domains observed in prior campaigns).

Detection Engineering Guidance

• Collect Sysmon Event ID 11 (FileCreate) and filter for “*.deadlock” extensions on Windows endpoints.
• Monitor Windows Security Event ID 4688 for PowerShell processes with “-EncodedCommand” arguments.
• Enable DNS logging and alert on queries to .onion TLDs from corporate networks.
• Correlate file creation of “DEADLOCK_README.txt” with recent mass file modifications within the same host.
• Ingest proxy and firewall NetFlow data to detect outbound TLS sessions to IPs associated with known TOR exit nodes.

Sigma Rules

title: Deadlock Ransomware File Extension Creation
id: 3f9c2a1e-5b7d-4f3a-9c2e-1a6d8f9b7c4e
status: stable
description: Detect creation of files with the .deadlock extension, indicative of Deadlock ransomware encryption activity.
author: CYBERDUDEBIVASH Sentinel Apex
date: 2026-08-20
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 11
        TargetFilename|endswith: '.deadlock'
    condition: selection
falsepositives:
    - Legitimate software that uses .deadlock extension (rare)
level: high
tags:
    - attack.t1486

Threat Hunting Queries

• Hypothesis: Deadlock creates files with .deadlock extension — Source: Sysmon (EventID 11) where TargetFilename ends with “.deadlock”.
• Hypothesis: Ransom note deployment – Source: Windows Security (EventID 4663) where ObjectName like “%DEADLOCK_README.txt%”.
• Hypothesis: PowerShell used for payload download – Source: Windows Security (EventID 4688) where ProcessName contains “powershell.exe” and CommandLine contains “-EncodedCommand”.
• Hypothesis: TOR C2 communication – Source: DNS logs where QueryName ends with “.onion”.
• Hypothesis: Large volume of file modifications in a short window – Source: Sysmon (EventID 11) where ImageLoaded time span < 5 minutes and Count > 500 per host.

SOC Analyst Playbook

• P0 – Verify alert: Check Sysmon EventID 11 for .deadlock files on the reported host; isolate the endpoint immediately.
• P0 – Capture volatile memory and disk image of the affected system for forensic analysis.
• P1 – Query Active Directory for recent privileged credential use (EventID 4624) on the same host.
• P1 – Review firewall and proxy logs for outbound TLS connections to .onion domains in the past 24 hours.
• P2 – Initiate internal breach notification workflow and begin GDPR impact assessment.
• P2 – Engage external ransomware negotiation/decryption service if ransom demand is received.

Executive Decision Matrix

Executive Recommendations

• Day 1‑7: Isolate compromised endpoints, block .onion DNS resolution, and deploy the Sigma rule for .deadlock file creation across all SIEMs.
• Day 8‑30: Harden PowerShell execution policies, enforce application allow‑list for executables, and conduct a sector‑specific phishing simulation for creative‑media staff.
• Day 31‑90: Integrate CYBERDUDEBIVASH Sentinel Apex live IOC feed into endpoint detection platforms, and formalize a quarterly ransomware tabletop exercise focused on data‑exfiltration response.

MSSP Opportunities

• Prioritize notification to clients in the UK creative‑media sector, highlighting the Deadlock ransomware claim

🔗 Related Intelligence Reports

• Same threat actor: Deadlock Ransomware Claims New Victim: Global Terminal Services | Transportation Sector
• Same threat actor: Deadlock Ransomware Claims New Victim: UFOC
• Related topic: everest Ransomware Claims New Victim: Experts Entreprendre | Professional Services Sector
• Related topic: everest Ransomware Claims New Victim: Kingston Technology | Technology Sector
• Related topic: krybit Ransomware Claims New Victim: sipresitalia.it | Manufacturing Sector