DeadLock ransomware uses blockchain to block takedown efforts
▼ Summary
– DeadLock ransomware, active since mid-2025, uses double-extortion tactics and had listed 80 mostly European organizations on its leak site by July, targeting sectors like IT, mining, and manufacturing.
– The operation uniquely stores configuration data and leak-site addresses on the Polygon blockchain, with the HTML page querying a smart contract via eth_call to retrieve chat-proxy addresses instead of using a traditional Tor URL.
– It relies on the decentralized Session network for encrypted victim communications and hosts stolen files on Wasabi cloud, reducing dependence on takedown-prone domains, though disruptions remain possible via proxy, RPC, or Wasabi removal.
– The encryption scheme avoids former Soviet Union, CIS countries, Iran, Syria, Oman, and Yemen; it deletes backups, stops virtualization, and encrypts non-system directories with XChaCha20 keys protected by Curve25519, using intermittent 512-byte blocks for large files.
– Ransom is demanded in Bitcoin or Monero for a decryptor, data deletion, and security advice, while Microsoft recommends defenses like EDR in block mode, tamper protection, Controlled Folder Access, and attack-surface reduction rules.
The DeadLock ransomware crew has built its operation on a foundation that makes conventional law enforcement takedowns significantly harder. By leaning on blockchain technology and decentralized communication networks, the group has created an infrastructure designed to resist disruption.
Active since mid-2025, DeadLock operates a double-extortion model, combining file encryption with data theft to maximize pressure on victims. The criminals threaten to leak stolen information unless a ransom is paid.
By July of this year, the group’s data leak site had already listed 80 victim organizations, with a heavy concentration in Europe. The affected sectors span IT, mining, transportation, manufacturing, hospitality, and consumer goods. Microsoft’s threat intelligence team has tracked the malware being deployed by several affiliates, including one with prior ties to the Lynx and INC ransomware ecosystems.
What sets DeadLock apart is its novel use of the Polygon blockchain. Instead of relying on a static Tor address for its leak site, the group stores configuration data and victim-facing posts on the blockchain. The HTML page itself retrieves the current chat proxy address by querying a smart contract through a read-only `eth_call` request.
This approach is not entirely new in the broader cybercrime world. Storing command-and-control (C2) addresses on the blockchain has become a common practice among criminals. However, its adoption within the ransomware space remains a rarity.
Beyond the blockchain layer, DeadLock also relies on the Session network, a decentralized messaging platform, to encrypt communications with victims. Stolen files are hosted on the Wasabi cloud service, adding another layer of separation from traditional infrastructure.
The practical benefit for the operators is clear. They can swap out the chat proxy at will without ever touching the victim-facing application. This reduces their dependence on conventional domains and web servers, which are the primary targets for seizure by law enforcement.
Still, Microsoft’s analysis points out that this resilience is not absolute. The communication flow still depends on a custom proxy, public Polygon RPC endpoints must stay reachable, and files stored on Wasabi could technically be removed. So while the setup complicates takedown efforts, it does not make them impossible.
On the technical side, DeadLock’s encryption scheme shows a high level of sophistication. The malware is configured to avoid systems in former Soviet Union countries, the CIS region, Iran, Syria, Oman, and Yemen. Before encryption begins, the locker deletes backups, halts virtualization services, and empties the Recycle Bin.
The encryption process itself targets select non-system directories. Each file is protected with a unique XChaCha20 key, which is then secured using the Curve25519 elliptic curve. To keep the victim’s machine usable during the attack, the ransomware is set to consume up to 29% of available memory and 70% of CPU resources. Larger files are encrypted intermittently in 512-byte blocks, a tactic that speeds up the process while still rendering the data largely unrecoverable.
Once encrypted, files are renamed with a victim-specific identifier and the `.dlock` extension. The system wallpaper is changed, desktop icons are altered, and TXT ransom notes are dropped to make the compromise unmistakable.
The ransom demand is payable in Bitcoin or Monero. In exchange, the attackers promise a decryptor, deletion of stolen data, disclosure of the initial access vector, and a set of security recommendations.
For defenders, Microsoft recommends a layered approach. Organizations should enable cloud-delivered antivirus protection, EDR in block mode, tamper protection, automated investigation and remediation, and automatic attack disruption. Additional safeguards include Controlled Folder Access to block unauthorized file changes and attack-surface reduction rules designed to stop untrusted executables and lateral movement via PsExec and WMI.
(Source: BleepingComputer)