- Published on
DeadLock Ransomware Uses Polygon Smart Contracts to Make Extortion Infra Harder to Disrupt
- Authors
- Name
- DeepHorus
The DeadLock ransomware group has adopted decentralized infrastructure, including Polygon smart contracts, to make its extortion operations significantly harder to disrupt, according to Microsoft Threat Intelligence. This marks a novel evolution in ransomware tactics, shifting away from centralized servers that law enforcement can seize. The group combines the Session messaging network with blockchain-backed services to store and deliver resources throughout the extortion process.
DeadLock was first detected in July 2025, employing double extortion tactics to encrypt victim environments and threaten public release of stolen data. As of this month, the group has claimed 96 victims, with the majority located in Italy, Spain, Poland, Turkey, and the United States. Microsoft observed the ransomware being deployed by multiple threat actors, including affiliates for Lynx and INC ransomware, indicating a widening reach. Group-IB noted that DeadLock has kept a lower profile than peers because it lacks a traditional data leak site and is not tied to known affiliate programs.
Technically, DeadLock encrypts files with a .dlock extension, uses a hybrid cryptographic design combining Curve25519 and XChaCha20, and implements selective encryption to exclude certain directories and file types. It also features geofencing to avoid execution in former Soviet and CIS-linked countries, as well as some Middle Eastern nations. A resource-aware throttling mechanism pauses encryption when memory usage exceeds 29% or CPU load exceeds 70%, helping evade detection.
The ransom note urges victims to download Session, a decentralized messaging app, and make payments in Bitcoin or Monero after providing a decrypted file as proof. The note also promises a security report and recommendations, along with assurances of no future attacks after payment. Perhaps most unusual is an HTML note dropped on all drives and desktops, containing a fully interactive web application with end-to-end encrypted chat, a paginated data leak blog, and a file browser—all without a traditional backend server.
This decentralized approach poses significant challenges for defenders. Traditional infrastructure takedowns become ineffective when extortion operations rely on blockchain and peer-to-peer networks. The use of Polygon smart contracts suggests DeadLock is experimenting with automated, censorship-resistant mechanisms for managing victim communications and data leaks.
As ransomware groups adopt such resilient infrastructure, security researchers expect this trend to grow. Microsoft continues to monitor DeadLock's activities, and the cybersecurity community will need new strategies to counter blockchain-based extortion. Future defenses may require blockchain analytics and closer cooperation with decentralized platform providers to mitigate this emerging threat.
