"Its recovery ecosystem combines the Session messaging network with blockchain-backed services that store and deliver resources used throughout the extortion process," the Microsoft Threat Intelligence team said.
How DeadLock uses decentralized chat and a self-contained HTML app
DeadLock’s operators build victim-facing communications on two decentralized mechanisms. The ransom note directs victims to use the Session messaging network for one-to-one negotiations and to pay in Bitcoin or Monero after receiving a decrypted proof file. Microsoft observed that operators also drop a single-page HTML application named RECOVERY_CHAT.<UID>.html into drive roots and Desktop folders. That file implements end-to-end encrypted chat, a paginated data leak blog, and a file browser, allowing victims to communicate and browse leaked content without downloading a separate backend-backed website.
Polygon smart contracts as a censorship-resistant proxy and leak host
Microsoft and Group-IB describe a novel technical twist: JavaScript inside the HTML file calls Polygon smart contracts to retrieve and rotate proxy server addresses. The smart contracts thus function as a decentralized directory that lets operators update proxy URLs without touching victim-facing domains or DNS registrations, a design that Microsoft said likely "increases the resilience" of DeadLock’s communication and leak-hosting infrastructure.
Two specific on-chain storage points were identified: wallet 0x8EF7c3e531d871D3B9D559722DE77EB1dEc19dAe, which stores the proxy server URL "138.226.236[.]51/prrq.php", and wallet 0x757984507c82c8dA1d3969c535dB5706eEE6426C, which stores blog posts. Microsoft noted the leak blog content is hosted on the Polygon blockchain and served via the Wasabi protocol, enabling browsable access to leaked files without running a traditional web server. Group-IB called the approach "an interesting method" that could be applied in many variants.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageTechnical profile of the locker and evasion techniques
DeadLock’s encryption and execution model combine several capabilities aimed at effective extortion and stealth:
- Files encrypted receive the ".dlock" extension; the malware also customizes file icons with a written ".ico" file and changes the wallpaper to read "Your infrastructure DeadLocked" alongside the ransom note.
- Cryptography is hybrid: Curve25519 elliptic-curve operations paired with the XChaCha20 stream cipher for file encryption.
- Selective encryption excludes chosen directories, file extensions, and file names; the locker also uses a language- and country-based geofence that avoids execution in environments linked to former Soviet and Commonwealth of Independent States (CIS) countries and select Middle Eastern countries.
- A "resource-aware throttling mechanism" pauses encryption when memory usage exceeds 29% or CPU load exceeds 70% to preserve system responsiveness; AnyDesk is used for remote control of compromised hosts.
- For defense evasion and forensic minimization, the malware erases logs and disables logging via Registry manipulation. The Windows locker runs a PowerShell script that stops non-allowlisted services, prevents them from restarting after reboot, deletes Volume Shadow Copies, erases the script itself, and finally creates a batch script to delete the malware binary and remove itself.
Operational footprint, timeline, and affiliations
Microsoft reported DeadLock was first detected in July 2025 and has since been deployed by multiple threat actors, including an affiliate for Lynx and INC ransomware. As of August 2026, the group has claimed 96 victims, with most located in Italy, Spain, Poland, Türkiye, and the U.S. Group-IB, in a January analysis, said DeadLock kept a comparatively low profile by not participating in known affiliate programs and by lacking a traditional data leak site; Ransomware.Live reported the first identified victims only in late May 2026.
What this means for technologists, policymakers, and affected enterprises
- Technologists and security teams: The decentralized proxy rotation and on-chain leak hosting shift parts of negotiation and disclosure infrastructure onto public blockchains, complicating domain- and hosting-based takedowns and requiring defenders to consider on-chain indicators such as the two identified wallets and the proxied URL.
- Policymakers and regulators: The reliance on public smart contracts and blockchain storage underscores how extortion actors can exploit open financial and ledger systems to make infrastructure harder to disrupt; regulators monitoring crypto-enabled abuse will find this case directly relevant to enforcement and takedown strategies.
- Affected enterprises and procurement leaders: The ransom note’s offer to provide a "security report" and post-payment "security recommendations" after receiving a decrypted file highlights an operational model where attackers blend extortion with consultative promises — enterprises should treat such assurances as part of coercion rather than remediation.
DeadLock represents a calculated evolution of ransomware tradecraft: it pairs traditional double extortion with an architecture that leverages end-to-end encrypted messaging and tamper-resistant smart-contract storage to reduce single points of failure. Microsoft concluded that this architecture "likely increases the resilience of portions of its communication, leak-hosting, and negotiation infrastructure," a blunt assessment that leaves defenders with a clear technical artifact list — filemarks like ".dlock", the RECOVERY_CHAT.<UID>.html app, the two on-chain wallets, and the proxied URL — to hunt and disrupt.
Read the original reporting: https://thehackernews.com/2026/08/deadlock-ransomware-uses-polygon-smart.html
