DeadLock Ransomware Uses Polygon Smart Contracts to Make Extortion Infra Harder to Disrupt
Microsoft reports DeadLock ransomware using Polygon smart contracts and Session messaging for extortion infrastructure, claiming 96 victims across Europe and the U.S.
Microsoft Threat Intelligence reports the DeadLock ransomware operation uses the Session messaging network and Polygon blockchain smart contracts to host victim chat, proxy server addresses, and its data leak blog, making takedowns harder. First detected in July 2025, the group has claimed 96 victims, mostly in Italy, Spain, Poland, Türkiye, and the U.S., with deployments by affiliates of Lynx and INC ransomware. The encryptor uses Curve25519 with XChaCha20, drops an interactive HTML recovery chat application, geofences CIS-linked countries, and clears logs and shadow copies to evade forensics.
- Proxy server addresses and leak blog content are stored and rotated via Polygon smart contracts, resisting takedowns
- 96 claimed victims across Italy, Spain, Poland, Türkiye, and the U.S.; deployed by Lynx and INC affiliates
- Hybrid Curve25519/XChaCha20 encryption with an interactive HTML recovery chat for negotiations
- Geofences CIS and select Middle Eastern countries; deletes logs, shadow copies, and uses AnyDesk for remote control
- ATT&CK
- T1486 Data Encrypted for ImpactT1490 Inhibit System RecoveryT1219 Remote Access SoftwareT1070.001 Clear Windows Event LogsT1562.002 Disable Windows Event Logging
- Vendors
- AnyDesk
- Organizations
- Microsoft Threat IntelligenceGroup-IB
- Countries
- ItalySpainPolandUnited States
From the original article
4 min read at thehackernews.com
The ransomware group known as DeadLock has been observed using decentralized infrastructure to facilitate victim communications and data leak operations in a bid to improve operational resilience. "Its recovery ecosystem combines the Session messaging network with blockchain-backed services that store and deliver resources used throughout the extortion process," the Microsoft Threat Intelligence team said .
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.