DeadLock Ransomware Pioneers Blockchain-Based Command-and-Control in Large-Scale Extortion Campaign
A ransomware group known as DeadLock has breached over 80 organizations across four continents since July 2025, deploying a novel tactic that sets it apart from other financially motivated threat actors: command-and-control (C2) infrastructure built on the Polygon blockchain. Microsoft Threat Intelligence detailed the group’s operations in an August 10 report, revealing a sophisticated extortion framework that leverages smart contracts, decentralized messaging, and cloud storage to evade traditional law enforcement takedowns.
A Censorship-Resistant Extortion Machine
Unlike conventional ransomware groups that rely on dark-web leak sites vulnerable to seizures or hosting provider interventions DeadLock’s infrastructure is effectively immune to disruption. Its core components include:
- Two Polygon smart contracts: One stores the current proxy server URL, while the other hosts the group’s blog posts and stolen data listings.
- Decentralized Session messaging: Victims communicate with operators via an onion-routed network, eliminating the need for centralized servers.
- Wasabi cloud storage: Stolen files are stored off-chain, with download links generated on demand via blockchain-stored metadata.
When an infected machine checks in, it queries public Polygon RPC endpoints to retrieve the latest proxy address no transactions, fees, or wallets required. Operators can rotate proxy servers by updating the smart contract, ensuring continuity even if individual components are disrupted. This technique, dubbed EtherHiding, was previously observed in North Korean-linked operations and the Aeternum botnet, but DeadLock is the first ransomware group to deploy it at scale in a double-extortion campaign.
Unbreakable Encryption and Stealthy Execution
DeadLock’s Rust-based encryptor employs a three-layer hybrid cryptographic scheme designed to eliminate recovery options:
- Per-file ephemeral Curve25519 keypairs: Each file generates a unique shared secret via elliptic-curve Diffie-Hellman, wrapped with XChaCha20 and Poly1305 for authenticated encryption.
- Tiered encryption: Files under 50 MB are fully encrypted, while larger files are chunk-encrypted (e.g., 10% of a 1 GB file), rendering them unusable without significantly increasing detection risk.
- Resource-aware throttling: Encryption pauses if CPU load exceeds 70% or memory use hits 29%, avoiding performance spikes that might trigger behavioral alerts.
Before encryption begins, DeadLock systematically disables defenses:
- Language-based exclusion: Self-deletes if the system language matches Russian, Ukrainian, CIS regions, or select Middle Eastern countries a pattern linked to operators avoiding local legal exposure.
- Service termination: Kills Windows Defender, Volume Shadow Copy, Hyper-V, Active Directory, and cloud sync clients (OneDrive, Dropbox, Google Drive).
- BYOVD (Bring Your Own Vulnerable Driver): Exploits CVE-2024-51324 in a signed Baidu Antivirus driver to gain kernel-level access, terminating EDR processes before they can respond.
- Event log destruction: Clears Windows logs, disables future logging, and restricts access permissions, leaving minimal forensic evidence.
Interactive Extortion via Blockchain and Decentralized Messaging
After encryption, victims receive:
- A ransom note (HOW_RECOVER.
.txt ) in every encrypted directory. - A self-contained HTML application (RECOVERY_CHAT.
.html ) that functions as a browser-based negotiation portal, requiring no server.
The Chat tab generates a Session messenger identity from victim credentials, enabling onion-routed communication with operators. The Blog tab fetches data-leak posts directly from the Polygon smart contract, allowing victims to browse stolen files via pre-signed Wasabi download URLs.
Targets and Operational Scale
DeadLock has impacted organizations in IT, mining, transportation, manufacturing, hospitality, and consumer goods, with over half of its 80+ victims in Europe and the remainder across Asia, the Americas, and Africa. The group operated quietly for 11 months before accelerating in June 2026, posting 75 new victims a pace rivaling established ransomware-as-a-service (RaaS) programs. Microsoft observed affiliates from the Lynx and INC ecosystems deploying DeadLock, suggesting a partial RaaS model.
The Future of Blockchain-Based Ransomware
Security firm ReliaQuest warned in its July 2026 quarterly report that blockchain-based C2 is likely to spread before year’s end, citing Cry0 ransomware’s adoption of the Internet Computer Protocol (ICP) blockchain for negotiations. The low technical barrier requiring only a smart contract and ~$1 in cryptocurrency means other groups may replicate DeadLock’s approach.
For defenders, monitoring outbound Polygon RPC traffic (e.g., to polygon-rpc.com, drpc.org) and Session messenger activity from enterprise endpoints could help detect similar threats. Microsoft’s mitigation recommendations include:
- Enabling tamper protection in Defender Antivirus.
- Running EDR in block mode to counter post-compromise telemetry loss.
- Enforcing Microsoft’s vulnerable-driver block list via Windows Defender Application Control (WDAC) with HVCI to block BYOVD attacks.
- Maintaining offline, immutable backups the only reliable recovery method against DeadLock’s encryption.
DeadLock’s SHA-256 encryptor hash (a1fdf65020ce4a0f0940c793c6425baf8a0b994ec48b9baaf72788661a9d29f4) and leak site domains (deadlock.liveblog365[.]com, dlock.liveblog365[.]com, deadlockblog.great-site[.]net) serve as key indicators of compromise. Encrypted files are appended with the .dlock extension.
Microsoft TPRM report: https://www.rankiteo.com/company/microsoft-threat-intelligence
"id": "mic1786568300",
"linkid": "microsoft-threat-intelligence",
"type": "Cyber Attack",
"date": "8/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'industry': ['IT',
'Mining',
'Transportation',
'Manufacturing',
'Hospitality',
'Consumer Goods'],
'location': ['Europe', 'Asia', 'Americas', 'Africa'],
'type': 'Organization'}],
'attack_vector': 'BYOVD (Bring Your Own Vulnerable Driver) via '
'CVE-2024-51324, phishing, or initial access brokers',
'data_breach': {'data_encryption': True,
'data_exfiltration': True,
'personally_identifiable_information': True,
'sensitivity_of_data': 'High (personally identifiable '
'information, corporate secrets)',
'type_of_data_compromised': 'Stolen files (sensitive '
'corporate data)'},
'date_detected': '2025-07-01',
'date_publicly_disclosed': '2026-08-10',
'description': 'A ransomware group known as DeadLock has breached over 80 '
'organizations across four continents since July 2025, '
'deploying a novel tactic that leverages command-and-control '
'(C2) infrastructure built on the Polygon blockchain. The '
'group uses smart contracts, decentralized messaging, and '
'cloud storage to evade traditional law enforcement takedowns, '
'employing a sophisticated extortion framework with '
'unbreakable encryption and stealthy execution methods.',
'impact': {'brand_reputation_impact': 'High (public data leaks via '
'blockchain-based blog)',
'data_compromised': 'Stolen files stored in Wasabi cloud storage, '
'downloadable via blockchain-stored metadata',
'identity_theft_risk': 'High (personally identifiable information '
'exposed in data leaks)',
'operational_impact': 'Encryption of files, termination of '
'critical services, destruction of event '
'logs',
'systems_affected': 'Windows systems with disabled defenses '
'(Windows Defender, Volume Shadow Copy, '
'Hyper-V, Active Directory, cloud sync '
'clients)'},
'investigation_status': 'Ongoing',
'lessons_learned': 'Blockchain-based C2 infrastructure is resistant to '
'traditional takedowns, requiring new detection methods '
'(e.g., monitoring Polygon RPC traffic). BYOVD attacks can '
'bypass defenses, necessitating driver block lists and EDR '
'in block mode.',
'motivation': 'Financial gain (double-extortion campaign)',
'post_incident_analysis': {'corrective_actions': ['Implement driver block '
'lists via WDAC with HVCI',
'Enable tamper protection '
'and EDR in block mode',
'Monitor outbound Polygon '
'RPC traffic',
'Maintain offline, '
'immutable backups'],
'root_causes': ['Exploitation of CVE-2024-51324 '
'(BYOVD attack)',
'Lack of tamper protection and EDR '
'in block mode',
'Insufficient monitoring of '
'blockchain-based C2 traffic']},
'ransomware': {'data_encryption': True,
'data_exfiltration': True,
'ransomware_strain': 'DeadLock (Rust-based encryptor)'},
'recommendations': ['Enable tamper protection in Defender Antivirus',
'Run EDR in block mode to counter post-compromise '
'telemetry loss',
'Enforce Microsoft’s vulnerable-driver block list via '
'WDAC with HVCI',
'Maintain offline, immutable backups',
'Monitor outbound Polygon RPC traffic and Session '
'messenger activity',
'Block known DeadLock indicators (e.g., SHA-256 hash, '
'leak site domains)'],
'references': [{'date_accessed': '2026-08-10',
'source': 'Microsoft Threat Intelligence Report'},
{'date_accessed': '2026-07-01',
'source': 'ReliaQuest Quarterly Report (July 2026)'}],
'response': {'containment_measures': 'Monitoring outbound Polygon RPC '
'traffic, blocking Session messenger '
'activity',
'enhanced_monitoring': 'Monitoring outbound Polygon RPC traffic '
'(e.g., polygon-rpc.com, drpc.org)',
'recovery_measures': 'Offline, immutable backups (only reliable '
'recovery method)',
'remediation_measures': ['Enabling tamper protection in Defender '
'Antivirus',
'Running EDR in block mode',
'Enforcing Microsoft’s '
'vulnerable-driver block list via WDAC '
'with HVCI',
'Maintaining offline, immutable '
'backups'],
'third_party_assistance': 'Microsoft Threat Intelligence, '
'ReliaQuest'},
'threat_actor': 'DeadLock Ransomware Group (affiliates from Lynx and INC '
'ecosystems)',
'title': 'DeadLock Ransomware Pioneers Blockchain-Based Command-and-Control '
'in Large-Scale Extortion Campaign',
'type': 'Ransomware',
'vulnerability_exploited': 'CVE-2024-51324 (Baidu Antivirus driver)'}