DeadLock does not break your antivirus: it stops it like any other service

Microsoft published its analysis of the DeadLock encryptor on 10 August, and titles it after the novel part: the decentralised infrastructure the gang uses to negotiate recovery. We will take the boring part of the same document, because it is the part we have to operate: the list of things it switches off before encrypting a single file. Encryption is the automatic bit; what decides whether the attack works happens in the minutes before, while someone stops services one by one and nobody gets an alert.

We are writing this from the side that picks up the pieces. We run managed EDR and MDR across other people's estates and we have seen this pattern often enough to hold an unpopular opinion: almost everyone buys a security product and almost nobody flips the three switches that stop that product from being turned off from the inside. DeadLock is not especially sophisticated. It is routine. Which is exactly why its routine is worth reading.

The service list tells you where the attacker is

DeadLock first appeared in July 2025 and, according to Microsoft, by July 2026 it had published more than 80 compromised organisations on its leak site, over half of them European. According to that same analysis, the encryptor stops — among others — these services: windefend, vss, swprv, wbengine, mssearch, vmcompute, vmms, adws, ntds and kdc. Read it again slowly, because it is not a list of antivirus products: it is a map.

• ntds, kdc and adws are the Active Directory database, the Kerberos key distribution centre and the directory's administration web service. ntds only exists on a domain controller; kdc is present but disabled on other Windows servers and only starts once the machine is promoted; adws shows up with either the AD DS or the AD LDS role. If the encryptor bothers to stop them, it is because it expects to run on a domain controller. That is our reading, not a Microsoft statement.
• vss, swprv and wbengine are volume shadow copies and Windows Backup. They are not security: they are recovery. They get stopped so the disk has nowhere to roll back to.
• vmcompute and vmms are Hyper-V's management services, not the hypervisor. Stopping them does not by itself power off running machines — each lives in its own worker process — but it leaves the host unable to start or manage them; together with killing those processes, the virtual disks stop being locked and become files like any other.

The process kill list points the same way and adds the detail we find most telling: alongside msmpeng, securityhealthservice and smartscreen you find onedrive, dropbox, googledrivefs and owncloud. Sync clients get killed because they are half the company's accidental backup. Whoever wrote this knows exactly how people actually recover lost files: from the folder that syncs by itself.

Defender is not broken: it is stopped

Here is the uncomfortable sentence in the report. To neutralise Microsoft Defender, DeadLock stops the windefend service and sets its start type to disabled. No exploit, no technique with a fancy name, nothing an administrator would not do on an ordinary Tuesday. It is the dullest operation in the operating system, performed by the wrong person.

Whether that works comes down mostly to one thing: whether tamper protection is off. That is not our reading; the mitigation list in Microsoft's own article asks for it in so many words, "to prevent attackers from stopping security services". On a managed estate, with it on, not even a local administrator can stop the engine the normal way: the change has to come from the management portal. And it is free: it ships with the product you already own, and it has been on by default for enterprise clients since 2022.

We find that box switched off with a frequency that no longer surprises us, and almost always for the same reasonable reason: someone disabled it two years ago so a line-of-business application would stop complaining, and nobody switched it back on. The note is still in the ticket. The box is not.

The logs are not cleared: they are switched off

This is the part that gets discussed least and gave us the most to think about. DeadLock does three things to the Windows event log, and only the first is the one everybody expects:

• It clears, through the classic API, the Application, Security, Setup, Servicing, Eventlog, Forwarded Events, Windows PowerShell and System channels.
• It walks the HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels tree and sets Enabled to 0 on every channel.
• It overwrites ChannelAccess with a restrictive SDDL descriptor, so write permission on those channels stops existing.

The difference between the first bullet and the other two is the difference between losing the past and losing the future. Clearing a log takes away what already happened. Disabling the channel and removing write permission means that from that second on the machine stops producing history: there is nothing to recover afterwards, because it was never written. The analyst who turns up on Monday with an intact disk does not find a gap in the timeline; they find the end of the timeline.

Hence the rule we apply without exception: a log that only lives on the machine that can be compromised is not a log, it is a note. Forwarding events to a collector outside the domain, with its own account and no delete permission from the source, does not cost licences; it costs an afternoon. And it is the difference between knowing how they got in and having to guess. It belongs to the same family of decisions as keeping the backup server inside the domain you are protecting: a dependency you only notice on the day you can no longer fix it.

When the kernel is needed (and why it usually is not)

There is an expensive version of the same move. In December 2025, Cisco Talos documented a loader used in a DeadLock attack that brings its own vulnerable driver: BdApiUtil.sys, a signed driver from Baidu's antivirus carrying CVE-2024-51324, an improper privilege management flaw. The trick is textbook, which is why it works: open the \\.\BdApiUtil device, send it IOCTL 0x800024b4 with the target process ID, and the driver calls ZwTerminateProcess without checking whether the caller is entitled to ask. From the kernel you can kill anything, including protected processes that are untouchable from user space. Its target list included engines from Microsoft, Symantec/Norton and McAfee.

Windows has a specific defence against this, Microsoft's vulnerable driver blocklist, and it pays to know exactly what it covers. It has been on by default since Windows 11 22H2, Microsoft updates it quarterly and also ships it with the monthly Windows updates. The small print is not the cadence: it is when it is enforced. It only applies if memory integrity (HVCI), Smart App Control or S mode is active — and that is precisely the box nobody has ever touched on a great many Windows servers, whether because of a storage driver, a card driver or backup software that does not support it. A real control, free, and doing nothing at all on many of the estates that reach us.

Now put that next to the fact we opened with: to switch off Defender, the encryptor Microsoft analysed needed none of it. No driver, no kernel, no CVE. It stopped a service. The expensive technique is only required when the cheap one is blocked, and the cheap one is blocked by a checkbox. That is the whole argument of this article.

The other advisory from the same day

Microsoft was not the only one publishing on 10 August. The same day brought joint advisory AA26-222A from CISA, the FBI and several other agencies, together with South Korea's national police, on the Gunra ransomware: first seen in April 2025, derived from the Conti source code leaked in 2022, turned into an affiliate service in early 2026, and getting in through known vulnerabilities in internet-facing devices, firewalls and VPN gateways included: in FortiOS and FortiProxy, CVE-2024-55591 and CVE-2025-24472. Its recommendations are the usual ones: patch what faces the internet, close or protect remote desktop, segment, and keep offline, immutable backups.

The two documents tell different halves of the same working day. One describes how they get in; the other, what gets switched off once inside. Almost all of a mid-sized company's security budget goes to the first — the firewall, the VPN, the patch — and almost none to the second. And the second is what decides whether the incident is a two-day scare or a two-week shutdown.

What actually survives this sequence

Ordered by cost, cheapest first. The first one costs no money: it costs a decision and a while spent on inventory.

• Tamper protection on, and audited. Turning it on once is not enough: you need to check regularly how many machines still have it, because the exception someone made two years ago is still alive.
• Event forwarding off the machine, in real time. If the log has not left the endpoint before the incident, it will not leave afterwards. Microsoft also recommends running EDR in block mode and the attack surface reduction rules — blocking executables without prevalence or age, and advanced ransomware protection. Check the invoice before assuming anything here: block mode requires Defender for Endpoint P2 or Defender for Business; the Defender that ships with Windows is not enough.
• Backups that depend on neither the domain nor the disk. Volume shadow copies are not backups: the encryptor itself treats them as the first obstacle to remove. We work with 3-2-1 and immutable copies because it is the only thing that survives an attacker holding domain admin credentials.
• Someone watching outside office hours. This is the one that costs money and the one that gets deferred. An EDR with nobody behind it is an expensive antivirus writing to a console nobody opens; the value of the managed service is not in the agent, it is in the shift. And for that shift to be worth anything, alerts have to be designed to wake somebody up, not to fill a monthly report.

When you should NOT buy an MDR

We will say it even though it is one of the services we sell: if you have twenty machines, tamper protection off and your backups on a USB disk plugged into the server, a managed service is not your next step. It is spending on surveillance what you should be spending on locking the door. Turn on the free switches, move the backups out of the domain, prove that you can restore — the only test that counts, and the one hardly anybody runs: the recovery numbers people sign without calculating deserve their own article — and then, if your exposure warrants it, we can talk about who watches the console at night.

We are not a reseller for any platform, so we can have this conversation in full. If you want to know how many machines in your estate still have tamper protection on, or whether your event logs leave the endpoint before someone can switch them off, get in touch and we will look. It is an hour of work and an uncomfortable answer.

The question we close on is the one we ask ourselves every time a new estate comes in: how long does it take someone to notice that a machine has stopped reporting? Not how many alerts it raises. How long silence takes to become a phone call.