DeadLock Ransomware Uses Polygon Blockchain to Resist Takedowns

Ransomware operators are increasingly shifting away from centralized infrastructure that can be seized or sinkholed by law enforcement. The DeadLock ransomware group has adopted a resilient, decentralized C2 and leak-site architecture built on top of the Polygon blockchain, using smart contracts as dead-drop resolvers for its active communication proxies.

By querying the public Polygon network via read-only eth_call requests, the ransomware payload dynamically retrieves its current victim chat proxy and configuration details without maintaining static domain names or hardcoded IP addresses. Combined with decentralized peer-to-peer messaging networks and cloud-hosted extortion repositories, DeadLock creates an infrastructure framework designed to survive traditional domain takedowns and server seizures.

Decentralized Infrastructure and Blockchain Resolvers

Using public blockchains to store command-and-control (C2) metadata is an established tactic for malware infrastructure, but its deployment within double-extortion ransomware operations remains relatively rare. DeadLock utilizes smart contracts deployed on the Polygon EVM (Ethereum Virtual Machine) blockchain to store both operational configurations and leak site announcements.

When a infected host needs to communicate with the threat actors’ infrastructure, the custom HTML landing page or local payload executes a read-only eth_call query against public Polygon RPC endpoints. This call reads data directly from a designated smart contract, returning the address of an active chat proxy server.

This model offers several operational advantages for the attackers:

• Takedown Resistance: Because the smart contract lives on the decentralized Polygon blockchain, law enforcement agencies cannot issue a domain seizure or host-level takedown against the configuration record.
• Agile Proxy Rotation: If defenders or ISPs block a specific chat-proxy server, the ransomware operators simply update the state variable inside the smart contract. All victim hosts immediately resolve to the new proxy address without requiring payload modifications or re-infection.
• Anonymized Victim Chat: Negotiation traffic is routed through the Session messaging network, an encrypted peer-to-peer communications protocol designed to conceal IP addresses and metadata. Stolen exfiltrated data is staged and delivered via the Wasabi commercial cloud storage service.

Despite this decentralization, the infrastructure is not entirely immune to disruption. The model still depends on public Polygon RPC endpoints remaining reachable from inside target networks, and files hosted on Wasabi can still be subjected to standard abuse takedown requests by the cloud provider.

DeadLock Technical Profile and Encryption Mechanics

First identified in mid-2025, DeadLock relies on affiliates for initial access and lateral movement. Security researchers at Microsoft have tracked DeadLock deployments back to cybercrime affiliates previously associated with the Lynx and INC ransomware ecosystems.

Once inside an enterprise environment, DeadLock prepares the local Windows host by stopping virtualization services, clearing the Recycle Bin, and deleting Volume Shadow Copies (vssadmin) to destroy local recovery points. The malware features a geographical exclusion check, terminating execution if it detects language or system locales associated with former Soviet states/Commonwealth of Independent States (CIS) countries, Iran, Syria, Oman, or Yemen.

The core payload features an optimized, high-speed encryption engine:

• Cryptographic Primitives: The locker generates unique per-file XChaCha20 symmetric keys to encrypt select non-system directories. These keys are then encrypted using Curve25519 public-key cryptography before being appended to the encrypted file.
• Resource Throttling: To avoid immediate detection via system performance spikes, DeadLock caps its own consumption to a maximum of 29% available system RAM and 70% CPU utilization. This allows host systems to remain somewhat responsive during the encryption phase, delaying user reports to SOC teams.
• Intermittent Block Encryption: For larger files, the locker encrypts intermittent 512-byte blocks rather than processing the entire file sequentially. This corrupts file headers and critical structural data in milliseconds, rendering the file unrecoverable without full decryption while drastically cutting down operational runtimes.
• Visual Artifacts: Encrypted files receive the .dlock extension and a customized file icon. The malware drops standard text ransom notes (README.txt) across affected directories and rewrites the desktop wallpaper with instructions to contact the threat group via their custom portal. Ransom payments are accepted exclusively in Bitcoin (BTC) or Monero (XMR).

Blast Radius and Operational Impact

DeadLock operates under a standard double-extortion business model, exfiltrating sensitive internal documents prior to launching local host encryption. By July 2025, the group’s leak site listed at least 80 compromised organizations, concentrated largely across European enterprise networks. Targeted sectors include IT services, industrial mining, transportation, manufacturing, hospitality, and consumer goods.

Because DeadLock affiliates frequently reuse established intrusion playbooks from the INC and Lynx operations, initial access typically stems from compromised enterprise credentials, unpatched edge devices, or exposed remote access infrastructure (such as VPNs and RDP endpoints). Once inside, attackers leverage native administrative utilities—such as PsExec and Windows Management Instrumentation (WMI)—to move laterally, harvest credentials, and stage the locker executable across multiple endpoints simultaneously.

Defense and Mitigation Guidance

Preventing DeadLock infections requires catching affiliate activity during the initial access and lateral movement phases before the ransomware locker is distributed across domain-joined hosts.

• Block Lateral Movement via WMI and PsExec: Enable Microsoft Attack Surface Reduction (ASR) rules to prevent process creations originating from PsExec and WMI commands (Block process creations originating from PSExec and WMI commands).
• Enforce Folder Access Restrictions: Deploy Controlled Folder Access on critical servers and endpoints to prevent unauthorized processes from writing to non-standard directories or modifying critical file structures.
• Secure Endpoint Defenses: Ensure Endpoint Detection and Response (EDR) solutions are deployed in active blocking mode across all hosts, with cloud-delivered protection and tamper protection features strictly enforced.
• Filter Polygon RPC Communications: Inspect outbound host traffic for unnecessary JSON-RPC calls directed at public Polygon endpoints (e.g., requests executing eth_call methods against remote RPC infrastructure) if there is no legitimate business requirement for blockchain interactions within the corporate network segment.