DeadLock Ransomware Uses Polygon To Keep Victim Chats Reachable

DeadLock ransomware has adopted a blockchain-backed recovery path for victim communications and leak-site updates, adding a resilience layer more often seen in malware command systems than in ransomware operations, BleepingComputer reported.

The change centres on the way the group keeps victim-facing services reachable after takedown attempts.

Microsoft researchers found that the DeadLock page queries a smart contract on the Polygon blockchain to retrieve the current chat-proxy address, rather than depending only on a fixed Tor address or a conventional web domain.

That architecture gives the operator a way to replace a chat proxy without changing the application shown to victims.

If a defender or law-enforcement agency removes one server, the address stored in the contract can point communications elsewhere while the victim-facing page keeps using the same lookup process.

Microsoft noted limits around the custom proxy, public Polygon RPC endpoints and files hosted on Wasabi, leaving DeadLock with a harder disruption target rather than an untouchable one.

DeadLock's wider infrastructure also uses the decentralised Session network to protect victim communications and Wasabi cloud storage to host stolen files.

Those choices spread the extortion workflow across several services instead of leaving all recovery, chat and leak functions in one place.

The ransomware group emerged in mid-2025 and uses double extortion, combining data theft with file encryption to pressure victims.

By July 2026, its leak site listed 80 organisations, mostly in Europe, across IT, mining, transportation, manufacturing, hospitality and consumer-goods sectors.

Microsoft observed the malware being deployed by multiple groups.

One affiliate had previous links to the Lynx and INC ransomware ecosystems, which makes DeadLock look less like a single isolated crew and more like tooling that can move through different criminal partnerships.

The encryption routine gives defenders another set of operational details.

DeadLock avoids countries in the former Soviet Union and Commonwealth of Independent States region, along with Iran, Syria, Oman and Yemen.

Before encryption, it deletes backups, stops virtualisation services and empties the Windows Recycle Bin.

The locker uses per-file XChaCha20 keys protected with Curve25519 elliptic-curve cryptography.

It is configured to consume up to 29% of available memory and 70% of CPU resources, allowing a victim machine to remain usable while files are being encrypted.

Microsoft's analysis says larger files are encrypted intermittently in 512-byte blocks, shortening the process while still leaving the data largely unusable without recovery material.

Encrypted files receive a victim-specific identifier and the .dlock extension, while ransom notes and a changed desktop wallpaper signal the compromise.

The attackers ask for Bitcoin or Monero in exchange for a decryptor, a promise to delete stolen data, information about the initial access vector and security recommendations.

The payment demand therefore combines restoration, confidentiality and post-incident explanation in one negotiation package.

For security teams, the immediate issue is incident continuity.

DeadLock does not need blockchain to encrypt files, but using Polygon to refresh recovery addresses gives the extortion process another route back online after infrastructure pressure.

The public material does not identify a single operator behind all DeadLock deployments.

The open question is how quickly affiliates can reuse the decentralised recovery model across new intrusions, and whether service-level removals can still interrupt enough of the payment and leak workflow to matter.