DeadLock Ransomware Leverages Polygon Blockchain to Evade Infrastructure Takedowns

The DeadLock ransomware operation has introduced an infrastructure model designed to resist law enforcement takedowns by utilizing smart contracts on the Polygon blockchain. Rather than depending exclusively on traditional Tor onion services or static domain names for command-and-control (C2) and victim communications, DeadLock embeds configuration details and leak site metadata directly into decentralized blockchain state. Coupled with encrypted routing via the Session network and cloud storage for exfiltrated files, this approach allows the group to modify victim communication proxies dynamically without pushing binary updates or risking domain seizures.

Decentralized Infrastructure and C2 Proxying

Ransomware operators historically relied on Tor network hidden services or fast-flux bulletproof hosting to operate victim payment portals and leak sites. While Tor offers anonymity, law enforcement agencies have repeatedly disrupted these operations through sinkholing, server seizures, and infrastructure takeovers.

DeadLock bypasses static hosting vulnerabilities by utilizing the Polygon blockchain as an immutable key-value store. When a victim opens the ransomware’s HTML landing page or communication interface, the page executes a read-only eth_call JSON-RPC query against public Polygon RPC nodes. This call queries a specific smart contract deployed on Polygon to retrieve the active chat-proxy address.

By offloading proxy resolution to a public blockchain, the threat actors gain several operational advantages:

• They can update payment and chat endpoints instantly by submitting a transaction to their smart contract.
• They avoid distributing updated ransomware binaries or hardcoding static IP addresses that firewalls can easily block.
• Law enforcement cannot unilaterally sinkhole or delete contract state stored across thousands of decentralized Polygon validator nodes.

To further obscure interactive communications, DeadLock routes negotiation traffic through Session, a decentralized messaging network built on the Oxen Service Node architecture. Exfiltrated files slated for double-extortion publishing are stored separately on Wasabi, an S3-compatible cloud storage platform.

While this decentralized architecture raises the barrier for permanent infrastructure takedown, it is not completely immune to disruption. The model still relies on public Polygon RPC endpoints remaining accessible from victim networks, Wasabi taking action on abuse reports to remove hosted stolen data, and custom local proxies running to bridge web traffic to the Session network.

Technical Analysis and File Encryption Flow

DeadLock’s binary payload executes a structured host preparation sequence prior to file encryption. It first attempts to neutralize recovery mechanisms by purging Windows Volume Shadow Copies (VSS), terminating active hypervisors and virtualization services, and clearing the Recycle Bin.

To maintain operational stealth and minimize immediate detection by system monitoring tools, DeadLock incorporates resource throttling logic. The ransomware constrains its process footprint to consume no more than 29% of total available system RAM and caps CPU utilization at 70%. This calculated resource ceiling ensures that the host machine remains reasonably responsive during background encryption, preventing immediate user alarm or automated performance alerts from triggering an early incident response.

The encryption engine relies on modern cryptographic primitives:

• Key Generation: Unique symmetric keys are generated per file using XChaCha20.
• Key Protection: Symmetric XChaCha20 keys are protected using an asymmetric Curve25519 public key embedded in the malware binary.
• Intermittent Encryption: For larger files, the locker employs an intermittent encryption pattern, encrypting alternating 512-byte blocks. This drastically speeds up execution across enterprise storage arrays while rendering files irrecoverable without the decryptor.

Encrypted files are renamed with a victim-specific identifier and the .dlock extension. The malware also alters system file association icons, drops text ransom notes throughout encrypted directories, and replaces the desktop wallpaper with a notice demanding payment in Monero or Bitcoin.

To prevent self-disruption and respect regional operational boundaries typical of Eastern European threat groups, DeadLock enforces strict keyboard layout and locale checks. The malware aborts execution if it detects language packs or system locales associated with Russia, Commonwealth of Independent States (CIS) member nations, Iran, Syria, Oman, or Yemen.

Operational Profile and Threat Actor Attribution

First observed in mid-2025, DeadLock operates under a double-extortion model, threatening to leak exfiltrated sensitive files if victims refuse to pay for a decryption key. Threat intelligence from Microsoft linked deployment activity to affiliates previously associated with the Lynx and INC ransomware ecosystems, indicating that experienced access brokers and ransomware-as-a-service (RaaS) affiliates are adopting the codebase.

By July 2025, the group’s data leak site had published stolen records from at least 80 target organizations, primarily located across Western Europe. Affected sectors span core industrial and commercial verticals, including IT services, mining, transportation, industrial manufacturing, hospitality, and consumer goods.

The potential blast radius for an affected enterprise is severe. Intermittent encryption corrupts hypervisor virtual disks, network-attached storage (NAS) shares, and local databases rapidly. Combined with cloud-backed exfiltration, organizations face both operational paralysis and regulatory disclosure liabilities.

Targeted Defenses and Hardening Guidance

Countering DeadLock requires targeted controls aimed at both its execution mechanisms and its unique network traits:

• RPC and Blockchain Traffic Inspection: Monitor and restrict outbound network traffic targeting public Ethereum and Polygon RPC gateways (such as Infura, Alchemy, or public Polygon endpoints). Block non-browser process calls issuing JSON-RPC eth_call payloads.
• Attack Surface Reduction (ASR) Rules: Deploy Microsoft Defender ASR rules specifically configured to block process creations originating from WMI and PsExec commands. Block untrusted and unsigned executables executing from temporary paths (%TEMP%, %APPDATA%).
• Controlled Folder Access: Enforce Controlled Folder Access policies across critical file shares and server volumes to prevent unauthorized processes from altering file extensions to .dlock or writing unknown files into system directories.
• EDR Enforcement: Ensure Endpoint Detection and Response (EDR) agents operate in active block mode with tamper protection enabled to prevent the malware from terminating local security agents or shadow copy management services.