DeadLock Ransomware Stores C2 on Polygon Blockchain — 96 Victims Across Four Continents, No Takedown Path

On 10 August 2026, Microsoft Threat Intelligence published a deep-dive that should give every security leader pause: a ransomware group called DeadLock has moved its command-and-control infrastructure onto the Polygon blockchain. Traditional ransomware takedowns rely on seizing servers and suspending domains — tactics law enforcement has refined over a decade. Neither of those levers works against a self-executing smart contract. For the first time, a financially motivated threat actor has engineered a ransomware operation designed to survive the very playbook that killed its predecessors.

Who Is DeadLock? Background and Affiliates

DeadLock first appeared in mid-2025 and operated quietly for several months before security researchers noticed a pattern in victim notifications. Rather than building its own affiliate pipeline from scratch, the operation recruited operators previously linked to the Lynx and INC ransomware ecosystems — groups known for high-tempo intrusions into mid-market enterprises. This explains DeadLock’s unusually mature initial-access tradecraft for such a young operation.

The group follows a classic double-extortion model: it exfiltrates sensitive data before deploying the encryptor, then threatens public release on its blockchain-hosted leak blog if the ransom is not paid. What makes DeadLock different is the infrastructure behind those threats — and Microsoft’s August 2026 analysis makes that infrastructure starkly clear.

The Blockchain Kill Switch: How Polygon Protects DeadLock’s C2

Most ransomware groups host their victim-communication portal on Tor hidden services. Law enforcement agencies have repeatedly demonstrated the ability to identify, seize, and disrupt those services — the takedowns of Hive, LockBit, and ALPHV/BlackCat stand as high-profile examples. DeadLock’s operators engineered around this weakness by moving the most critical configuration data onto the Polygon blockchain.

Specifically, the group maintains two Polygon smart contracts:

Contract Purpose	Contract Address
Chat proxy URL store — rotatable without victim-side updates	0x8EF7c3e531d871D3B9D559722DE77EB1dEc19dAe
Data-leak blog — hosted directly on-chain with pagination	0x757984507c82c8dA1d3969c535dB5706eEE6426C

When a victim’s machine runs DeadLock’s HTML recovery application, it queries the proxy contract via a read-only eth_call against public Polygon RPC endpoints (including polygon-bor-rpc.publicnode.com and polygon.drpc.org). If law enforcement forces one proxy offline, the operators simply write a new proxy address to the smart contract — and the victim application immediately connects to the new location. No new malware binary required. No victim notification needed. No domain to seize.

Victim communications are then routed through the Session decentralised messenger, with messages padded to 160-byte boundaries and signed with Ed25519 to prevent tampering. Stolen files are hosted on Wasabi cloud storage. As Microsoft noted: “This infrastructure model represents a meaningful evolution from traditional ransomware communication channels and poses new challenges for takedown efforts.”

Inside the Encryptor: Technical Breakdown

DeadLock’s Rust-based encryptor is built around a cryptographically sound combination that leaves victims with no decryption shortcut:

• XChaCha20 stream cipher for per-file symmetric encryption
• Curve25519 ECDH + XSalsa20-Poly1305 (NaCl crypto_box) for key encapsulation — each file gets a fresh ephemeral keypair
• The encrypted footer appended to each file contains the ephemeral public key and metadata; only the operator’s embedded private key can recover the symmetric key

To avoid detection and system overload, the encryptor uses a resource-aware throttling mechanism — it pauses when system memory exceeds 29% utilisation or CPU idle drops below 30%. This extends dwell time but dramatically reduces the likelihood of triggering performance-based alerts. File size determines encryption depth:

• Files under ~50 MB: 100% encrypted
• ~50–118 MB: 50% encrypted (distributed chunks)
• ~118–500 MB: 25% encrypted
• Over ~500 MB: 10% encrypted

Before encryption begins, the malware executes a systematic pre-encryption preparation sequence:

• UAC elevation via randomly named .cmd files using the RunAs verb
• Token privilege escalation — enabling SeDebugPrivilege, SeBackupPrivilege, SeRestorePrivilege
• Terminating Windows Defender (windefend), Volume Shadow Copy services (vss, swprv, wbengine), and all backup-adjacent processes
• Clearing Windows Event Logs via API and wevtapi.dll enumeration — destroying forensic evidence
• Killing cloud backup sync agents: OneDrive, Dropbox, Google Drive, OwnCloud
• Killing remote-access tools: AnyDesk, PuTTY, RustDesk, mstsc (RDP)

A geofencing check runs at start-up: if the system locale matches Russian (1049), Ukrainian (1058), Belarusian (1059), Persian (1065), or several other CIS/Middle-Eastern locales, the binary self-deletes. This pattern is a strong indicator of operator origin in the CIS region. The SHA-256 hash of the known encryptor sample is a1fdf65020ce4a0f0940c793c6425baf8a0b994ec48b9baaf72788661a9d29f4. Encrypted files receive a .dlock extension.

96 Victims Across Four Continents — Who Is at Risk?

As of August 2026, DeadLock’s blog lists 96 claimed victims, with Italy, Spain, Poland, Türkiye, and the United States among the most heavily hit countries. Europe accounts for over 50% of victims. Targeted sectors include:

• Information technology and managed service providers
• Mining and heavy industry
• Transportation and logistics
• Manufacturing
• Hospitality and consumer goods

The heavy representation of IT and MSP targets is particularly alarming. As we covered with Gunra ransomware earlier this month, threat actors increasingly view managed service providers as force-multipliers — compromise one MSP and you gain a foothold in dozens of downstream enterprise networks simultaneously. Ransomware demands are paid in Bitcoin or Monero, with decryption, data deletion, and a post-incident security consultation promised in return.

What You Should Do: Defence-in-Depth Against Blockchain C2

As a zero-trust architect and NOC/SOC practitioner with 30 years of field experience, here is my recommended hardening posture against DeadLock and its inevitable successors:

1. Block Polygon RPC Endpoints at the Perimeter

DeadLock’s smart contract queries target a finite set of public Polygon RPC endpoints. On FortiGate and similar NGFW/SDWAN platforms, create application-layer rules to deny outbound connections to polygon-bor-rpc.publicnode.com, polygon.drpc.org, polygon-pokt.nodies.app, polygon-rpc.com, 1rpc.io/matic, and polygon.meowrpc.com. Also deny the Session messenger network domains. This disrupts the C2 channel even if the encryptor runs.

2. Enforce Controlled Folder Access and Strict Backup Integrity

Enable Windows Controlled Folder Access across all endpoints, and ensure backup solutions do not run with the same privilege context that ransomware targets. Immutable offline backups — ideally following the 3-2-1-1-0 rule — remain the only guaranteed recovery path when no decryptor exists.

3. Deploy EDR in Block Mode with Tamper Protection

DeadLock kills Defender and cloud-sync agents early. An EDR solution running in block mode with tamper protection enabled can interrupt the privilege escalation chain before the encryptor launches. Microsoft Defender for Endpoint detects this family as Ransom:Win32/Deadlock.*.

4. Monitor for Event-Log-Clearing Events

Log clearing (Windows Event ID 1102 and 104) is one of DeadLock’s earliest observable behaviours. SIEM rules alerting on mass event-log deletion, combined with VSS deletion alerts (vssadmin delete shadows), can trigger an incident response before encryption completes.

5. Zero-Trust Identity and Lateral-Movement Controls

As recent incidents have repeatedly demonstrated, attackers pivot from one compromised identity to full domain control quickly. A zero-trust segmentation model — where every lateral connection is re-authenticated and logged — shrinks the blast radius dramatically. Prioritise privileged access workstations (PAWs) and just-in-time admin access for domain controllers and backup systems.

Frequently Asked Questions

Can law enforcement take down DeadLock’s infrastructure?

Not through traditional domain seizure or server takedown. The Polygon smart contracts storing C2 configuration are immutable once deployed and not controlled by any single hosting provider. Microsoft notes some residual weaknesses — communications still require a custom proxy, and files on Wasabi can be removed — but the core C2 rotation mechanism is genuinely resistant to conventional interdiction.

Is there a free decryptor available?

No. The XChaCha20 + Curve25519 combination used by DeadLock has no known cryptographic weakness. Each file is encrypted with a unique ephemeral keypair, and only the operator-controlled private key can recover data. Prevention and immutable backups are the only reliable protection.

What is the connection between DeadLock and older ransomware groups?

Microsoft observed that several DeadLock operators were previously affiliated with the Lynx and INC ransomware ecosystems. This explains their high operational tempo and effective initial-access tradecraft — they have brought years of enterprise-targeting experience to a technically superior platform.

Should Indian enterprises and MSPs be worried?

Yes. While DeadLock’s current victim list is Europe-heavy, the group targets sectors — IT services, manufacturing, logistics — that are core to India’s enterprise economy. India’s growing MSP ecosystem makes it an attractive target; compromise of one MSP could give attackers reach into dozens of corporate networks simultaneously. CERT-In’s 6-hour breach reporting mandate makes timely detection even more critical.

---

Is Your Organisation Ready for Blockchain-Resilient Threats?

DeadLock marks a threshold moment: the gap between commodity ransomware and nation-state-grade infrastructure is closing. If your NOC/SOC does not have active blocks on blockchain RPC endpoints, tamper-protected EDR, and zero-trust lateral-movement controls in place today, you are operating with an incomplete defence against the next generation of ransomware.

Sanjay Seth and the team at P J Networks have spent three decades helping Indian enterprises and multinationals build layered, zero-trust security architectures that hold — even when attackers bring novel evasion techniques. Book a complimentary security assessment today to identify the gaps in your current posture before a group like DeadLock finds them first.

Sources: Microsoft Security Blog · BleepingComputer · The Hacker News · Cybersecurity News