Ransomware Group Hardens Infrastructure via Smart Contracts

The ransomware operation known as DeadLock has taken a page from decentralized finance to keep its extortion machinery running. According to Microsoft's Threat Intelligence team, the group has adopted an infrastructure model that leans on blockchain and encrypted messaging to shield its communications from takedowns—a shift that could make life harder for defenders.

Decentralized Extortion Infrastructure

In a technical analysis published this week, Microsoft detailed how DeadLock's recovery ecosystem combines the Session messaging network with blockchain-backed services that store and deliver resources used throughout the extortion process. The goal, the company said, is operational resilience—the ability to keep negotiating with victims even if authorities or security firms try to cut off their channels.

The group was first detected in July 2025, using double extortion tactics: encrypting victim environments and then threatening to leak stolen data unless a ransom is paid. As of this month, DeadLock has claimed 96 victims, with most located in Italy, Spain, Poland, Türkiye, and the U.S.

Polygon Smart Contracts as a Shield

Perhaps the most unusual aspect of DeadLock's operations is its use of an HTML note—dubbed "RECOVERY_CHAT.<UID>.html"—dropped in all drive root directories and all Desktop folders. Unlike a simple text note, this HTML file functions as a fully interactive web application, complete with end-to-end encrypted chat, a paginated data leak blog, and a file browser, all running without a traditional backend server.

The HTML file communicates with a proxy server, and the details of that server are managed via Polygon smart contracts. Specifically, JavaScript code within the HTML file interacts with those contracts to rotate proxy server addresses in a decentralized manner. This turns the infrastructure into something censorship- and takedown-resistant, allowing the operator to update proxy URLs without touching victim-facing domains or registering new ones.

Microsoft noted that the recovery chat page also provides access to a data leak blog whose content is hosted on the Polygon blockchain. This offers browsable access to leaked files without running a web server, using the Wasabi protocol. The two wallet addresses used by the threat actor are:

• 0x8EF7c3e531d871D3B9D559722DE77EB1dEc19dAe, which stores the proxy server URL ("138.226.236[.]51/prrq.php")
• 0x757984507c82c8dA1d3969c535dB5706eEE6426C, which stores the blog posts

An Unusual Use of Blockchain

In an analysis published earlier this January, Singapore-based Group-IB highlighted the group's low profile, attributing it to DeadLock not being associated with any known affiliate programs and lacking a data leak site (DLS). According to Ransomware.Live, the first set of victims was not discovered until late May 2026.

Group-IB's report also noted the peculiar choice of using smart contracts for proxy address delivery. "This exploit of smart contracts to deliver proxy addresses is an interesting method where attackers can literally apply infinite variants of this technique," the firm said.

Technical Depth of the Locker

On the technical side, DeadLock encrypts files with the ".dlock" extension, changes file icons using a custom ".ico" file written to disk, and modifies the victim's desktop wallpaper to display the message "Your infrastructure DeadLocked" and instruct them to open the ransom note. The ransomware adopts a selective encryption model, excluding certain directories, file extensions, and file names from encryption. It employs a hybrid cryptographic design that combines Curve25519 elliptic-curve cryptography with the XChaCha20 stream cipher for file encryption.

The ransomware also includes a language- or country-based geofencing to avoid execution in environments associated with former Soviet and Commonwealth of Independent States (CIS)-linked countries as well as select Middle Eastern countries. It features a "resource-aware throttling mechanism" that ensures system responsiveness as encryption proceeds, pausing when memory usage exceeds 29% or CPU load exceeds 70%. It relies on AnyDesk for remote control of compromised hosts.

For defense evasion, the Windows version of the locker uses a PowerShell script to stop services that are not allowlisted and ensure they are not executed automatically after reboot. The script also deletes Volume Shadow Copies and erases itself to cover tracks. As a final cleanup step, the malware creates a batch script to delete its own binary from disk and then remove itself.

Ransom Notes and Negotiation Tactics

The ransom note urges victims to download a decentralized, end-to-end encrypted messaging application called Session to get in touch and make a Bitcoin or Monero payment after sharing a decrypted version of a locked file as proof. One version of the note also claims to provide the compromised company with a "security report" that details the steps the attackers took to break into their network. Furthermore, the note states that victims who make a payment will receive security recommendations to stop future attacks, along with assurances that they will not be targeted again in the future.

Microsoft's analysis said the group has been deployed by multiple threat actors, including an affiliate for Lynx and INC ransomware.

Why This Matters for Defenders

Microsoft's assessment is clear: "This infrastructure model represents a meaningful evolution from traditional ransomware communication channels and poses new challenges for takedown efforts." The company added that "this architecture likely increases the resilience of portions of its communication, leak-hosting, and negotiation infrastructure, allowing DeadLock operators to recover from some disruption efforts while maintaining continuity for victims."

For security teams and incident responders, this suggests that conventional disruption tactics—like seizing domains or taking down leak sites—may be less effective against groups that adopt decentralized infrastructure. The bar for disrupting such operations could rise, requiring new strategies that address the blockchain-based components. Companies targeted by DeadLock will need to understand that the attackers have built in redundancy that may keep pressure on even if parts of their operation are taken down.