Emerging ThreatsMalware & Ransomware

DeadLock Ransomware Leverages Blockchain to Evade Takedown

Analyst 207||Source: BleepingComputer
Modern cityscape with sleek buildings and subtle tech infrastructure.

By July this year, DeadLock’s public leak site listed 80 organizations — a surprising concentration of victims, mostly in Europe — and the group behind the ransomware is deliberately using decentralized building blocks to make itself harder to cut off.

Use of the Polygon blockchain to hide operational addresses

Microsoft researchers report DeadLock operators moved critical infrastructure components onto the Polygon blockchain. Instead of embedding a static Tor URL in victim-facing pages, the ransomware’s HTML retrieves the current chat-proxy address by querying a smart contract on Polygon via a read-only eth_call. The technique places configuration data and leak-site posts on-chain, allowing the operator to change the chat proxy without altering the victim-facing application or relying on conventional domains and web servers that can be seized or taken down.

Microsoft cautions that while retrieving command-and-control addresses from blockchains is a tactic increasingly used by cybercriminals, it remains rare in the ransomware space.

Decentralized communications: Session network and Wasabi hosting

DeadLock combines multiple decentralized services. The group uses the Session network to encrypt victim communications and relies on the Wasabi cloud service to host stolen files. Together with the Polygon smart-contract trick, these elements reduce dependence on traditional infrastructure. Microsoft notes this approach “resists” some disruption methods, but the resistance is not absolute: communications still depend on a custom proxy; public Polygon RPC endpoints must remain accessible; and files hosted on Wasabi can be removed.

Encryption scheme, operational footprint, and victim treatment

The malware prepares Windows hosts in a deliberate way: it deletes backups, stops virtualization, and empties the Recycle Bin before proceeding. It encrypts selected non-system directories using unique per-file XChaCha20 keys that are protected with the Curve25519 elliptic curve. Larger files are intermittently encrypted in 512-byte blocks to speed the process while rendering them largely unrecoverable.

To keep the host usable during encryption, DeadLock is configured to use up to 29% of available system memory and up to 70% of CPU resources. Encrypted files are renamed with a victim-specific identifier and the “.dlock” extension, icons are changed, TXT ransom notes are dropped, and the desktop wallpaper is altered to indicate the system has been locked. Operators seek ransom in Bitcoin or Monero in exchange for a decryptor, a promise to delete stolen data, disclosure of the initial access vector, and a set of security recommendations.

Victim profile and observed operator activity

Microsoft observed DeadLock emerging in mid-2025 and using double-extortion tactics — both data theft/leak and file encryption. By July, the leak site listed 80 organizations, largely European, spanning IT, mining, transportation, manufacturing, hospitality, and consumer goods sectors. Researchers also saw the malware deployed by multiple groups, including an affiliate previously linked to the Lynx and INC ransomware ecosystems.

What this means for technologists, procurement leaders, and end users

  • Technologists and security teams: Microsoft’s defensive guidance centers on strengthening endpoints and containing post-compromise activity. Recommended controls include cloud-delivered antivirus protection, EDR in block mode, tamper protection, automated investigation and remediation, and automatic attack disruption. Organizations should also use Controlled Folder Access to restrict unauthorized file changes and enable attack-surface reduction rules that block untrusted executables and lateral movement tools such as PsExec and WMI.
  • Procurement leaders and enterprise IT: The reliance on decentralized services means takedown of a single domain will not necessarily stop the operation; defenders must consider resilience of access to public blockchain RPC endpoints and the ability to monitor or take down hosted files on services such as Wasabi.
  • End users and operations teams: Microsoft’s researchers highlight an operational reality — “overall prevention scores can hide what happens after initial access.” Once attackers operate with valid credentials, many preventive controls lose effectiveness, so detection and rapid response remain crucial.

DeadLock demonstrates a pragmatic assembly of decentralized components — blockchain smart contracts for configuration, Session for private messaging, cloud hosting for stolen data — to complicate disruption efforts. Microsoft’s analysis shows those layers raise the bar for takedown but do not make operators invulnerable: the chain of dependencies (custom proxy, public RPC endpoints, and removable cloud-hosted files) still provides points of intervention. For defenders, the lesson is concrete: harden endpoints, limit credential misuse, and prepare rapid response playbooks that assume adversaries will use resilient infrastructure.

Source: BleepingComputer — DeadLock ransomware uses blockchain to resist infrastructure takedown

BlockchainCybercrimeEmerging ThreatsEuropeNation-StateRansomwareSupply ChainMalware OperationsPolygonDeadlock Ransomware
Related Intelligence

Continue Reading

A typical defense sector industrial setting with a computer workstation in the mid-ground, surrounded by ordinary activity.

Lazarus Group Exploits Microsoft Zero-Day in Global Defense Sector Attacks

North Korea's notorious Lazarus Group has been exploiting a Microsoft zero-day vulnerability, CVE-2026-68820, since early June, targeting the global defense sector with alarming precision. This high-severity flaw, patched in August, allowed attackers to execute code with SYSTEM-level privileges, putting countless systems at risk.

Analyst 207
System administrator looks concerned at phone with Telegram conversation, surrounded by work materials on desk.

Sandworm Hackers Exploit VPN Client in IT Pro Targeting Scam

Beware of fake job interviews! Cyber attackers, linked to the notorious Sandworm group, are targeting IT pros with bogus job offers, tricking them into installing a malicious VPN client to gain access to sensitive info.

Analyst 207
Technicians work in a network operations center with rows of computer servers and networking equipment.

Kimwolf Botnet Evolves to Evade DDoS Detection

The Kimwolf botnet has levelled up its game with a new upgrade, v7, which uses HTTP/2 floods to mimic real browser traffic, making it super tricky to detect as a DDoS attack. This sneaky move lets the botnet build complete browser fingerprints, blurring the line between legit and malicious traffic.

Analyst 207
Windows computer workstation on a clean office desk with a blank laptop screen.

Microsoft Patches Zero-Day Windows Driver Flaw Under Active Attack

Microsoft just patched a high-severity Windows driver flaw, known as CVE-2026-68820, that was already being exploited by hackers in the wild. This zero-day vulnerability, with a CVSS score of 7.0, could be triggered by a race condition, allowing attackers to gain a foothold in targeted systems.

Analyst 207