DeadLock: the blockchain serving blackmail
The ransomware landscape is reaching a new level. According to a detailed technical analysis published on August 10, 2026, by Microsoft Threat Intelligence, the group behind the ransomware DeadLock has deployed a decentralized communication and data leakage infrastructure, relying on the Polygon blockchain to make its operations particularly difficult to dismantle.
First appearing in July 2025, DeadLock practices classic double extortion — encrypting systems on one hand, stealing and threatening to publish data on the other. But it is its resilience architecture that sets it apart: instead of relying on traditional servers or Tor services that can be seized, the operators use smart contracts on the Polygon blockchain to store and distribute their communication proxy addresses as well as the postings on their leak site.
Polygon as infrastructure registry
The mechanism is as ingenious as it is concerning. DeadLock drops an interactive HTML file (RECOVERY_CHAT.<UID>.html) on the victim's machine that acts as a standalone web application: end-to-end encrypted chat, paginated leak blog, and stolen file browser, all without a traditional backend server.
Instead of using a classic Tor URL, this HTML page queries a smart contract on the Polygon blockchain via a read-only call (eth_call) to retrieve the current chat proxy server address. This enables operators to replace the proxy at will without modifying the victim-side application, and without having to register or maintain domains that could be seized.
Two Polygon wallet addresses have been identified by researchers:
- 0x8EF7c3e531d871D3B9D559722DE77EB1dEc19dAe: stores the proxy server URL (
138.226.236[.]51/prrq.php) - 0x757984507c82c8dA1d3969c535dB5706eEE6426C: stores the leak blog postings
The content of the leak blog itself is hosted on the Polygon blockchain, accessible via the Wasabi protocol, allowing victims and the public to view the stolen data without the need for any web server. Encrypted communications with victims pass through the decentralized Session network, an alternative to Signal designed to function without a central server.
A resilience that is not absolute
However, Microsoft emphasizes that this architecture is not invulnerable. Communications still pass through a custom proxy that can be targeted; the public RPC endpoints of Polygon must remain accessible for the system to function; and files hosted on Wasabi can be deleted. Thus, the resistance to disruptions is real but not absolute.
The firm Group-IB, which published an initial analysis of DeadLock in January 2026, highlighted the originality of the approach: “This exploitation of smart contracts to deliver proxy addresses is an interesting method where attackers can literally apply an infinite number of variations of this technique.” Group-IB also noted that DeadLock initially kept a low profile, with no public leak site or affiliation to a known program, with the first victims only discovered at the end of May 2026 according to Ransomware.Live.
Victims primarily European
The evolution in the number of victims shows a rapid escalation. Microsoft indicates that over 80 organizations were listed on the leak site in July 2026. The Hacker News, citing more recent data from August 2026, reports 96 claimed victims, the majority located in Italy, Spain, Poland, Turkey, and the United States.
The targeted sectors cover a wide spectrum: information technology, mining, transportation and logistics, manufacturing, hospitality, consumer goods. The geographic presence of the victims extends to Europe, Asia, North and South America, as well as Africa.
Microsoft observed that the DeadLock malware is deployed by several distinct groups, including one previously linked to the Lynx and INC ransomware ecosystems — two blackmail operations that themselves have been the subject of recent law enforcement actions or dismantlements.
Encryption designed for discretion
The Microsoft report delves in detail into the encryptor itself, written in Rust. Its hybrid cryptographic scheme combines Curve25519 (elliptic curve for key exchange) with symmetric encryption XChaCha20 for the contents of files. Each file has its own unique symmetric key, encapsulated via the crypto_box construction from the NaCl library. According to Microsoft, the cryptographic construction is robust and presents no practical path for decryption without the attacker’s private key.
A distinctive feature is the resource-aware throttling mechanism. DeadLock continuously monitors memory and CPU usage: if memory exceeds 29% or CPU load exceeds 70%, the dispatch of new files for encryption is paused. The objective is to keep the machine sufficiently responsive so that the victim does not notice anything during the operation, and for the resource consumption patterns to resemble normal activity, thus avoiding behavioral detection.
For large files, DeadLock applies a staged partial encryption strategy:
| File Size | Percentage Encrypted |
|---|---|
| < 50 MB | 100% |
| 50 – 118 MB | 50% |
| 118 – 500 MB | 25% |
| 500 MB – 1 GB | 10% |
| > 1 GB | "chunked-full" mode |
This intermittent block encryption of 512 bytes renders files unusable while significantly accelerating the process — a crucial compromise for databases, virtual machine images, and backups.
Geofencing and anti-forensics
Like many ransomware, DeadLock implements a geographical filter based on the system language: it self-deletes immediately if the detected language corresponds to a country from the former USSR or CIS (Russia, Ukraine, Belarus, Kazakhstan, etc.), as well as Iran, Syria, Oman, and Yemen. A pattern that strongly suggests the operators are operating from this region.
On the anti-forensic side, the malware is methodical: it empties the recycle bin, deletes Volume Shadow Copy snapshots, disables Windows Defender and backup services, stops Hyper-V and Active Directory services, and clears all Windows event logs through three complementary methods (classic API, registry manipulation, enumeration via wevtapi.dll). After encryption, a batch script deletes the ransomware binary itself.
Encrypted files receive the extension .dlock, a victim-specific identifier, a custom icon, and the wallpaper is replaced with a message: “Your infrastructure DeadLocked”.
Ransom in Bitcoin or Monero
The ransom note, delivered as a TXT file and an interactive HTML page, demands payment in Bitcoin or Monero. In exchange, the operators promise a decryptor, the deletion of stolen data, details about the initial access vector, and even a “security report” with recommendations to avoid future attacks — a promise whose sincerity remains obviously unverifiable.
Defense Recommendations
Microsoft recommends that organizations strengthen their endpoint defenses via:
- A cloud-delivered antivirus with blocking mode protection
- EDR in blocking mode with tampering protection
- Automated investigation and remediation
- Controlled Folder Access to restrict unauthorized file modifications
- Attack surface reduction rules to block untrusted executables and lateral movements through PsExec and WMI
The emergence of DeadLock marks a significant step in the evolution of ransomware: the blockchain is no longer just a means to receive anonymous payments; it becomes a key component of operational infrastructure, designed to withstand coordinated dismantlement efforts. Law enforcement, which has increased seizures of Tor infrastructures and domains in recent years, will now need to adapt to an adversary that moves part of its command logic onto immutable and decentralized blockchain ledgers.