The DeadLock ransomware group, first identified in July 2025, has been observed employing innovative techniques to enhance the resilience of its operations. Notably, the group utilizes Polygon blockchain smart contracts to manage and rotate proxy server addresses, complicating efforts to disrupt their infrastructure.
Unlike many ransomware operations, DeadLock does not affiliate with known programs or maintain a public data leak site. This low-profile approach, combined with its technical sophistication, has drawn attention from cybersecurity researchers.
Innovative Use of Blockchain Technology
DeadLock’s recent samples include an HTML file that facilitates communication with victims via the Session encrypted messaging platform. Instead of relying on hard-coded servers, the malware retrieves proxy addresses stored within a Polygon smart contract. This method allows the group to dynamically update and rotate proxy servers without generating blockchain transactions, thereby avoiding network fees and complicating traditional blocking methods.
The JavaScript code embedded in the HTML file queries a specific Polygon smart contract to obtain the current proxy URL. This proxy then relays encrypted messages between the victim and the attacker’s Session ID. Key aspects of this approach include:
- Decentralized storage of proxy addresses on the Polygon blockchain.
- Fallback mechanisms utilizing multiple RPC endpoints.
- Use of smart contract functions to update infrastructure on demand.
Researchers have linked multiple smart contracts to a single creator wallet, funded shortly before deployment. Transaction histories indicate active management of the infrastructure, with new proxy servers being set over time.
Broader Implications for Cybersecurity
Beyond its use of blockchain technology, DeadLock employs tools like AnyDesk for remote management and deploys PowerShell scripts to halt services and delete shadow copies, increasing the impact of encryption. Victims’ files are renamed with a .dlock extension, and ransom notes threaten to sell stolen data if payment is not made.
Similar blockchain-based techniques have been reported in other campaigns, including cases where smart contracts were used to store malicious payloads or command locations. DeadLock’s use of Polygon smart contracts demonstrates how decentralized platforms can be repurposed for resilient command-and-control (C2) operations.
This trend suggests that the abuse of public blockchains for malware operations is likely to grow, challenging defenders to adapt detection strategies without disrupting legitimate use of decentralized technologies.
As ransomware groups continue to innovate, the cybersecurity community must remain vigilant and develop countermeasures to address these evolving threats. The use of blockchain technology for malicious purposes underscores the need for comprehensive monitoring and adaptive defense strategies.
