The DeadLock ransomware group uses blockchain technology to make parts of its infrastructure harder to take down. The criminals store information about their communication channels on the Polygon blockchain. This makes them less dependent on domains and servers that law enforcement agencies can shut down.
This was reported by BleepingComputer. DeadLock has been active since mid-2025 and combines encryption with data theft. Microsoft observed the ransomware being used by various attackers, including an affiliate previously linked to Lynx and INC. In July, the group’s own data leak site listed 80 victims, primarily European organizations.
Chat address via smart contract
Particularly notable is the way DeadLock has set up communication with victims. The web application that victims use to contact the group does not simply include a fixed address for the chat server. Instead, the application queries a smart contract on the Polygon blockchain for the current address of a proxy.
This allows DeadLock to switch proxies without modifying the application used by victims. As a result, removing or blocking a single domain is less effective. According to BleepingComputer, the use of blockchain to store command-and-control information is already common in cyberattacks, but remains relatively uncommon in ransomware.
Furthermore, DeadLock uses the decentralized Session network for communication itself. Stolen files are made available via the Wasabi cloud storage service.
This setup does not make the infrastructure invulnerable. Microsoft points out that the chat still relies on a specific proxy. Additionally, Polygon’s public RPC endpoints must be accessible, and files can be deleted from Wasabi.
Efficient encryption
The ransomware itself is also designed to operate quickly and relatively inconspicuously. Before DeadLock encrypts files, the malware deletes backups, terminates virtualization processes, and empties the Windows Recycle Bin.
Separate XChaCha20 keys, secured with Curve25519, are used for each file. Large files are only partially encrypted, in 512-byte blocks. This allows DeadLock to operate faster while still rendering the files largely unusable.
The ransomware also limits itself to a maximum of 29 percent of available memory and 70 percent of processing power, so an infected computer may still appear to be functional during the attack.
Encrypted files are given the .dlock extension. Ransom instructions are then displayed, and the Windows desktop background changes. DeadLock demands payment in Bitcoin or Monero.
The ransomware avoids systems in former Soviet republics and Commonwealth of Independent States countries. Iran, Syria, Oman, and Yemen are also excluded.
Microsoft advises organizations to enable, among other things, EDR in block mode, tamper protection, and Controlled Folder Access. Attack Surface Reduction rules can also help block suspicious programs and lateral movement via PsExec and WMI.