DeadLock ransomware fortifies itself with blockchain infrastructure

The DeadLock ransomware operation has adopted a decentralized infrastructure that leans on blockchain technology, insulating its communication with victims and data-leak pages from conventional disruption tactics. According to a new report from Microsoft, the group stores configuration data and leak-site posts on the Polygon blockchain, a step that reduces its dependence on traditional domains and servers that law enforcement can seize.

Emergence and early activity

The threat actor surfaced in mid-2025, according to the report, and quickly embraced double-extortion methods—stealing victim data and encrypting files to pressure organizations into paying ransoms. By July [this year], the group's data leak site listed 80 organizations, mostly from Europe, with victims spanning the IT, mining, transportation, manufacturing, hospitality, and consumer goods sectors.

Microsoft researchers observed the malware being deployed by multiple groups, including an affiliate previously linked to the Lynx and INC ransomware ecosystems. This suggests that DeadLock is not a single, monolithic operation but rather a platform that other criminal actors can leverage.

Blockchain-backed resilience

The ransomware operators implemented a novel approach: using the Polygon blockchain to store configuration data and the posts on the leak site. Instead of using a traditional Tor URL, the victim-facing HTML page retrieves the current chat-proxy address by querying a smart contract on the Polygon blockchain through a read-only eth_call. This means that if one proxy address is taken down, the operators can update the smart contract, and the victim-facing pages will automatically fetch the new address, without needing to modify the application.

While retrieving command-and-control (C2) addresses stored on the blockchain is now a common tactic for cybercriminals, Microsoft notes that it remains a rare occurrence in the ransomware space. This innovative use of blockchain technology represents a significant evolution in ransomware resilience.

Decentralized communication and hosting

In addition to the blockchain-based configuration, DeadLock uses the decentralized Session network to encrypt victim communications. Access to stolen files is provided through the Wasabi cloud service, which offers another layer of resilience. The combination of these technologies allows the operators to replace the chat proxy without modifying the victim-facing application, and it reduces their dependence on conventional infrastructure that can be disrupted by law enforcement.

However, Microsoft noted that communications still require the custom proxy, public Polygon RPC endpoints must remain accessible, and files hosted on Wasabi can be removed. As a result, the resistance to disruptions is not absolute, and law enforcement still has avenues to counter the operation.

Encryption scheme details

Microsoft's report also dives into DeadLock's encryption system, which is configured to avoid countries in the former Soviet Union and the Commonwealth of Independent States (CIS) region, as well as Iran, Syria, Oman, and Yemen—likely to minimize legal repercussions for the operators. After preparing the Windows host by deleting backups, stopping virtualization, and emptying the Recycle Bin, the locker encrypts select non-system directories using unique per-file XChaCha20 keys protected with the Curve25519 elliptic curve.

The ransomware is designed to use up to 29% of the available system memory and 70% of CPU resources, allowing the victim to continue using the machine during the encryption process without major performance hiccups. Larger files are intermittently encrypted using 512-byte blocks to speed up the process while still making them mostly irrecoverable. Encrypted data is renamed with a victim-specific identifier and the '.dlock' extension, the icons are changed, TXT ransom notes are dropped, and the desktop wallpaper is changed to indicate that the system has been locked.

Ransom demands and payment options

The attackers request ransom payments in Bitcoin or Monero in exchange for a decryptor, a promise to delete the stolen data, details about the initial access vector, and a set of security recommendations. The use of privacy-focused cryptocurrencies like Monero makes tracing payments more difficult for investigators.

Defensive recommendations

To defend against DeadLock ransomware attacks, Microsoft recommends strengthening endpoint defenses through cloud-delivered antivirus protection, EDR in block mode, tamper protection, automated investigation and remediation, and automatic attack disruption. Organizations should also restrict unauthorized file changes using Controlled Folder Access and enable attack-surface reduction rules to block untrusted executables and lateral movement via PsExec and WMI.

The report also highlights a broader challenge: Once attackers have valid credentials, only 37% of their actions are blocked. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.

Why this matters

The adoption of blockchain-based resilience by DeadLock could signal a shift in ransomware tactics, making it harder for authorities to dismantle operations. For defenders, the key takeaway is the importance of early detection and robust credential protection, since ransomware groups increasingly leverage valid credentials to bypass preventive layers. The ability to disrupt ransomware infrastructure remains a critical tool, but as operations like DeadLock demonstrate, criminals are adapting to maintain their foothold.