DeadLock Ransomware Takes Advantage of Blockchain to Evade Takedown
The DeadLock ransomware operation has been making headlines for its innovative use of blockchain technology to protect its communication channels with victims, as well as its data-leak activity. The malware, which emerged in mid-2025, uses double-extortion tactics to pressure organizations into paying a hefty ransom.
Victims of the attack include 80 companies from various sectors such as IT, mining, transportation, manufacturing, hospitality, and consumer goods, with most being based in Europe. Microsoft researchers have observed that DeadLock’s data leak site has been actively used by multiple threat actors, including an affiliate previously linked to the Lynx and INC ransomware ecosystems.
What sets DeadLock apart from other ransomware operations is its use of the Polygon blockchain to store configuration data and posts on the leak site. Instead of relying on traditional Tor URLs, the HTML page retrieves the current chat-proxy address by querying a smart contract on the Polygon blockchain through an eth_call function. This approach allows the attackers to replace the chat proxy without modifying the victim-facing application.
Furthermore, DeadLock uses the decentralized Session network to encrypt victim communications and provides access to stolen files hosted on the Wasabi cloud service. This enables the operators to reduce their dependence on conventional domains and web servers, which can be taken down by law enforcement agencies. However, Microsoft notes that communications still require a custom proxy, public Polygon RPC endpoints must remain accessible, and files hosted on Wasabi can be removed, so resistance to disruptions isn’t absolute.
The DeadLock encryption scheme is also noteworthy. The malware is configured to avoid encrypting data from countries in the former Soviet Union and the Commonwealth of Independent States (CIS) region, as well as Iran, Syria, Oman, and Yemen. Once the Windows host has been prepared by deleting backups, stopping virtualization, and emptying the Recycle Bin, the locker encrypts select non-system directories using unique per-file XChaCha20 keys protected with the Curve25519 elliptic curve.
In an effort to evade detection, DeadLock is configured to use up to 29% of available system memory and 70% of CPU resources, allowing victims to continue using their machine during the encryption process without significant performance hiccups. Larger files are intermittently encrypted using 512-byte blocks to speed up the process while still making them mostly irrecoverable.
To defend against DeadLock ransomware attacks, Microsoft recommends strengthening endpoint defenses through cloud-delivered antivirus protection, EDR in block mode, tamper protection, automated investigation and remediation, and automatic attack disruption. Organizations should also restrict unauthorized file changes using Controlled Folder Access and enable attack-surface reduction rules to block untrusted executables and lateral movement via PsExec and WMI.
The use of blockchain technology by DeadLock ransomware highlights the evolving landscape of cyber threats. As threat actors become more sophisticated in their tactics, it’s essential for organizations to stay vigilant and adapt their security measures accordingly. By understanding the techniques used by DeadLock, organizations can better prepare themselves against similar attacks and reduce the risk of falling victim to a devastating ransomware attack.
Source: Bleeping Computer — 2026-08-11