DeadLock Ransomware Exploits Polygon Blockchain to Build Near-Indestructible Extortion Network

A ransomware group called DeadLock is using Polygon smart contracts and decentralized infrastructure to power extortion operations that are significantly harder for authorities and cybersecurity teams to disrupt or take down.

The Microsoft Threat Intelligence team confirmed the threat in August 2026, warning that DeadLock's architecture marks a meaningful and troubling evolution from traditional ransomware communication channels. With 96 confirmed victims across five continents and blockchain-backed infrastructure that resists conventional takedown efforts, DeadLock is quietly reshaping the ransomware threat landscape.

---

A Ransomware Group Built for Resilience

DeadLock was first detected in July 2025 and employs double extortion tactics — encrypting victim environments while simultaneously threatening to publicly release stolen data. According to Ransomware.Live, the first victims were not publicly identified until late May 2026.

Most victims have been located in Italy, Spain, Poland, Türkiye, and the United States. The group has operated with unusual stealth. Singapore-based cybersecurity firm Group-IB noted earlier this year that DeadLock maintained a lower profile than its peers partly because it has no known affiliate program and lacks a traditional data leak site. To understand the broader context of how this category of attack operates, it helps to first understand how ransomware works and why it continues to evolve.

That anonymity did not last. Microsoft confirmed that multiple threat actors have deployed DeadLock's ransomware, including affiliates linked to the Lynx and INC ransomware operations. The group's reach is expanding and its technical sophistication is raising urgent alarms across the cybersecurity industry.

Infection Behaviour and Initial Indicators

When DeadLock infects a system, it encrypts files with the ".dlock" extension, replaces file icons with a custom image file, and rewrites the victim's desktop wallpaper to read: "Your infrastructure DeadLocked." Victims are then instructed to open a ransom note and contact the group via Session, a decentralized end-to-end encrypted messaging application.

The ransomware uses a hybrid cryptographic model combining Curve25519 elliptic-curve cryptography with the XChaCha20 stream cipher. It also applies geofencing logic to avoid executing in environments tied to former Soviet, Commonwealth of Independent States, and select Middle Eastern countries — a deliberate effort to evade attention from law enforcement in those regions.

This geofencing behaviour is consistent with a pattern seen among sophisticated ransomware operations that are structured to avoid triggering criminal jurisdiction in regions where operators may reside or have implicit protection.

---

How Blockchain Makes This Threat Different

What separates DeadLock from conventional ransomware groups is its use of Polygon smart contracts to manage proxy server addresses. Rather than relying on traditional servers or registered domains that can be seized or blocked, DeadLock embeds JavaScript within an HTML recovery file that queries the Polygon blockchain directly to retrieve current proxy server locations. Understanding how blockchain and smart contracts function is increasingly relevant for security professionals assessing this new class of threat.

"This exploit of smart contracts to deliver proxy addresses is an interesting method where attackers can literally apply infinite variants of this technique," Group-IB said in its January 2026 analysis.

The Two Wallet Addresses at the Centre of DeadLock's Infrastructure

Two Polygon wallet addresses have been identified by researchers:

• 0x8EF7c3e531d871D3B9D559722DE77EB1dEc19dAe — stores the active proxy server URL
• 0x757984507c82c8dA1d3969c535dB5706eEE6426C — stores blog posts from the group's data leak operation

By hosting this content on the blockchain using the Wasabi protocol, DeadLock gives anyone with the HTML file browsable access to stolen data without the group ever needing to operate a traditional web server.

This is not merely a technical footnote. It means that law enforcement cannot simply seize a server or force a registrar to suspend a domain. The infrastructure lives on a decentralized network that no single authority controls — and that distinction has profound implications for how defenders and policymakers must respond.

Microsoft described the impact plainly: "This architecture likely increases the resilience of portions of its communication, leak-hosting, and negotiation infrastructure, allowing DeadLock operators to recover from some disruption efforts while maintaining continuity for victims."

Why Traditional Takedown Strategies Fall Short

Conventional law enforcement responses to ransomware — seizing servers, suspending domains, disrupting payment infrastructure — assume that criminal operations depend on centralised, identifiable assets. DeadLock's model dismantles that assumption. Because the infrastructure is distributed across a public blockchain, there is no single point of failure to target. Each proxy address update is a simple on-chain transaction, executable in seconds, from anywhere in the world.

This represents a structural shift in how ransomware operations can be architected. Security teams that have not yet evaluated how blockchain-based command-and-control infrastructure changes their threat modelling assumptions should treat DeadLock as a prompt to do so.

---

Operational Details Security Teams Need to Know

Beyond its blockchain infrastructure, DeadLock employs several techniques designed to evade detection and complicate forensic investigation.

Evasion, Encryption and Self-Destruction

The Windows version of the locker uses a PowerShell script to stop non-allowlisted services, delete Volume Shadow Copies, and disable logging through Registry manipulation. A final batch script deletes the ransomware's own binary from disk after encryption completes — eliminating one of the most common artefacts forensic investigators rely on.

The group also includes a resource-aware throttling mechanism that pauses encryption when memory usage exceeds 29% or CPU load exceeds 70%. This keeps compromised systems responsive enough that victims may not immediately notice unusual activity. Remote access during attacks is maintained using AnyDesk — a legitimate tool being weaponised to maintain persistent access throughout the attack lifecycle.

The Recovery File as a Self-Contained Weapon

The interactive HTML recovery file dropped on victim systems functions as a self-contained web application — complete with encrypted chat, a paginated data leak blog, and a file browser — requiring no backend server to operate. DeadLock's ransom note also offers victims a "security report" detailing how attackers breached their network, along with promises of security recommendations and assurances against future targeting in exchange for payment. Whether those promises carry any weight is another matter entirely.

DeadLock's model is a sobering reminder that, much like the decentralized finance world it borrows from, criminal infrastructure can now be built to be censorship-resistant by design.

What Security Teams Should Prioritise Now

Knowing how to respond effectively to a ransomware attack has never been more critical, particularly as the window between initial compromise and full encryption continues to narrow with operationally efficient groups like DeadLock.

For security professionals monitoring this threat, the following operational priorities apply:

• Endpoint detection should flag PowerShell-based log deletion and Volume Shadow Copy removal as indicators of active ransomware deployment — both are high-confidence signals of an attack in progress
• Threat modelling assumptions must be revised to account for blockchain-based command-and-control infrastructure, since traditional domain blocking and server seizure strategies are unlikely to be effective against this class of attack
• Remote access tool auditing — particularly AnyDesk usage across the environment — should be reviewed immediately, as threat actors are increasingly weaponising legitimate tools to maintain persistent access during attacks
• Geofencing and cryptographic indicators such as the .dlock extension and Curve25519/XChaCha20 hybrid encryption signatures should be incorporated into detection rulesets where possible

The CISA Ransomware Guide remains a foundational reference for organisations building or stress-testing their ransomware response plans in light of evolving threats like DeadLock.