DeadLock Ransomware Uses Polygon Smart Contracts to Hard-Proof Extortion

The DeadLock ransomware group has adopted a decentralized operational model that combines the Session messaging network with blockchain-backed services to make its extortion infrastructure significantly harder to take down, according to Microsoft's Threat Intelligence team. First detected in July 2025, the group has since claimed 96 victims—concentrated in Italy, Spain, Poland, Türkiye, and the United States—while avoiding association with any known affiliate programs and initially operating without a public data leak site. Attacks are attributed to multiple threat actors, including an affiliate linked to both the Lynx and INC ransomware families, signaling broad adoption of the DeadLock builder across the cybercriminal ecosystem.

Technically, DeadLock employs a selective encryption strategy that skips specific directories, extensions, and filenames, paired with a hybrid cryptographic scheme combining Curve25519 elliptic-curve cryptography and the XChaCha20 stream cipher. Encrypted files carry the ".dlock" extension, a custom icon, and a desktop wallpaper reading "Your infrastructure DeadLocked." The malware also includes a resource-aware throttling mechanism that pauses encryption when memory usage exceeds 29% or CPU load surpasses 70%, preserving system stability while exfiltrating data. To evade analysis, it implements language- and country-based geofencing that excludes former Soviet and Commonwealth of Independent States (CIS) regions along with select Middle Eastern countries, and relies on AnyDesk for remote control of compromised endpoints. Victims are directed to communicate over Session, a decentralized end-to-end encrypted messenger, and pay in Bitcoin or Monero after submitting a sample decryption as proof.

The most notable evolution is DeadLock's move to host its recovery chat infrastructure and data leak resources on the Polygon blockchain, eliminating single points of failure that have historically allowed law enforcement and security vendors to dismantle ransomware operations. Some ransom notes even promise a post-payment "security report" outlining the attack vector and recommendations to prevent reinfection—suggesting a maturing, semi-professionalized business model. With the first batch of confirmed victims only surfacing in late May 2026 via Ransomware.Live, the group's low pre-2026 profile allowed it to scale quietly before discovery. Organizations concerned about exposure should verify that no corporate credentials have appeared in known leaks using an email breach checker, enforce strong unique credentials validated through a password checker, and audit publicly reachable services with an SSL/TLS checker to ensure encrypted transport is correctly configured across remote access and management endpoints.