-
DeadLock ransomware now stores its command server addresses on the Polygon blockchain instead of normal websites.
-
The gang has hit more than 80 companies since mid 2025, mostly in Europe.
-
Microsoft says the setup makes DeadLock harder to shut down, but it is not unbreakable.
A ransomware group called DeadLock built a new kind of hideout for itself. Instead of using regular web servers, it now hides its command links inside a public blockchain. This move makes it harder for police and security teams to shut the gang down.
Microsoft Threat Intelligence studied the malware closely and shared fresh details this month. The group steals files first, then locks them, and demands payment to give victims their data back.
How DeadLock Hides Its Command Servers
DeadLock first showed up in the middle of 2025. It steals data from a company, then encrypts the files too. This trick is called double extortion, and it pushes victims to pay faster. By July this year, DeadLock had listed more than 80 victims on its leak page. Most of these victims are companies based in Europe. The gang has struck companies in tech, mining, transport, factories, hotels, and consumer goods.
Microsoft researchers saw several different groups using this same malware. One of them had ties to the Lynx and INC ransomware gangs before. That link shows DeadLock may share tools or people with older criminal crews.
The biggest change is how DeadLock talks to its victims. Older ransomware groups used Tor links that police can trace and take down. DeadLock instead stores its chat server address on the Polygon blockchain. A victim’s browser reads a smart contract to find the current server. This method uses a plain, read only request, so no crypto wallet is needed to check it.
Storing server addresses on a blockchain is not new for hackers in general. But it rarely shows up in ransomware attacks. DeadLock also uses a network called Session to keep victim chats private. Stolen files sit on a storage service called Wasabi, ready for victims to view. Together, these three tools let the gang swap out its chat server anytime. They do this without changing the app that victims actually open.
According to Microsoft, this setup marks a real shift away from older ransomware communication methods and creates fresh problems for anyone trying to shut the gang down. Still, the system has weak spots.
The custom chat proxy must stay online. Public Polygon servers must stay reachable too. Files stored on Wasabi can still be deleted by that company. So the setup helps DeadLock survive longer, but it can still be disrupted.
Locking Files While the Computer Still Works
DeadLock’s encryption tool skips certain countries on purpose. It avoids former Soviet states, nearby CIS nations, and also Iran, Syria, Oman, and Yemen. This pattern often hints at where the malware’s creators may be based.
Before locking files, the malware prepares the computer first. It deletes backup copies. Also it stops virtual machines from running. It empties the Recycle Bin too. Then it encrypts chosen folders using a strong method called XChaCha20. Each file gets its own unique key, protected by another method called Curve25519.
The malware also tries to stay quiet while it works. It uses up to 29% of the computer’s memory. It uses up to 70% of the processor power. This limit lets the victim keep using their computer without noticing much slowdown. Larger files get encrypted in small 512-byte chunks. This speeds up the attack while still making files unusable.
Once a file is locked, DeadLock renames it. Each victim gets their own unique file tag, plus the “.dlock” ending. File icons change too. The malware drops text notes demanding payment. It even changes the desktop wallpaper to show the computer has been locked.
The attackers ask for payment in Bitcoin or Monero. In return, they promise a decryption tool. They also promise to delete the stolen copies. Victims may get details on how the hackers first broke in, along with security tips.
How to Guard Against DeadLock
Microsoft shared several steps that organizations can take now. Turn on cloud based antivirus tools across all computers. Enable EDR tools in block mode, not just alert mode. Turn on tamper protection so attackers cannot disable defenses.
Automated investigation tools can also catch threats early. Attack disruption features can stop malware before it spreads far. Companies should also block unwanted changes to important folders. This can be done using a feature called Controlled Folder Access.
Attack surface reduction rules help too. These rules can block programs that are not trusted. They can also stop attackers from moving between computers using tools like PsExec and WMI. Regular backups, kept away from the main network, remain one of the strongest defenses against any ransomware attack, including DeadLock.
Microsoft threat advisory highlights how attackers are using social engineering to deliver malware via WhatsApp messages, with Visual Basic Script files disguised as harmless attachments that trigger a multi-stage infection chain leading to remote access backdoors.
