DeadLock Ransomware Uses Blockchain To Dodge Takedowns

A ransomware operation tracked as DeadLock has built its victim-communication and data-leak systems around blockchain technology, making the group's infrastructure considerably harder for defenders and law enforcement to dismantle. Security researchers first flagged the technique in a report published this month, and Microsoft has now released a detailed technical breakdown confirming how the malware operates, from initial compromise through file encryption to post-attack extortion.

The findings illustrate a broader shift in how ransomware crews are engineering their operations to survive the kind of coordinated takedowns that have disrupted several prominent extortion groups in recent years.

DeadLock emerged in mid-2025 and follows the now-common double-extortion model, stealing data from victim networks before encrypting files and threatening to expose it publicly if a ransom is not paid. By July 2026, the group's leak site listed more than 80 compromised organizations, the majority of which were based in Europe, spanning the IT, mining, transportation, manufacturing, hospitality, and consumer goods sectors.

Microsoft has observed ransomware being deployed by several groups, including an affiliate previously linked to the Lynx and INC ransomware operations, suggesting the malware is shared or sold among multiple criminal crews rather than operated by a single team.

What sets DeadLock apart from most ransomware families is the way its operators have restructured their back-end infrastructure to resist disruption. Rather than pointing victims to a conventional Tor hidden-service address, the ransom note directs them to an HTML file that behaves like a self-contained web application.

That file queries a smart contract on the Polygon blockchain using a read-only function call to retrieve the current address of a proxy server, which then relays communications to the rest of the group's systems.

This approach means the operators can change their proxy server at will simply by updating the smart contract, without ever having to alter the ransom note or the victim-facing application itself.

Because the configuration data lives on a public, distributed ledger rather than a server that can be seized, taken offline, or blacklisted, the group sidesteps one of the more effective tools law enforcement has traditionally used against ransomware gangs: dismantling the domains and servers that victims are directed to.

Storing malicious command-and-control information on a blockchain is not itself a new idea. Cybercriminals have previously hidden scripts inside Binance Smart Chain contracts, and state-linked hacking groups, including North Korean operators, have used a similar technique known as "EtherHiding" to conceal malware instructions on-chain. What makes DeadLock notable is that this tactic, common in broader cybercrime and espionage circles, remains rare in ransomware operations.

DeadLock extends the same decentralized philosophy to other parts of its extortion pipeline. Victim communications are routed through Session, a decentralized and encrypted messaging network built on onion-style routing, rather than a custom chat server that the group would need to maintain and protect.

Stolen files offered to victims or published to pressure them are hosted on the Wasabi cloud storage service and accessed via an embedded, browser-based file explorer built directly into the HTML ransom note.

Together, these choices let DeadLock's operators recover quickly from partial disruptions. If a proxy server is seized, they can simply publish a new address to the blockchain. If a chat relay goes down, the underlying Session network continues to function independently.

That said, Microsoft's researchers noted that the design is not fully immune to disruption. Victim communications still depend on a working proxy server; the HTML page needs access to at least one public Polygon RPC endpoint to function, and files hosted on Wasabi can still be taken down by the hosting provider if identified. In other words, DeadLock's blockchain layer removes some of the traditional pressure points defenders rely on, but it does not eliminate all of them.

Microsoft's Technical Breakdown of the Encryptor

Alongside the infrastructure analysis, Microsoft's threat intelligence team dissected the ransomware's Windows-based encryption component in depth. Before encrypting anything, the malware checks the system's default and interface languages and quietly deletes itself if it detects a match in countries across the former Soviet Union and the Commonwealth of Independent States, as well as in Iran, Syria, Oman, and Yemen.

This geofencing pattern is frequently observed among ransomware crews believed to be based in those regions, since it reduces the risk of prosecution at home.

Once running, the malware attempts to secure administrative privileges, empties the Recycle Bin, terminates security software and backup tools, disables Volume Shadow Copy and related recovery services, and clears event logs across multiple channels to hinder forensic investigation. Encryption itself relies on a hybrid scheme that pairs the XChaCha20 stream cipher for file content with Curve25519 elliptic-curve key exchange to protect each file's encryption key.

Microsoft's analysis found the cryptographic implementation technically sound, offering no practical means of decryption without the attackers' private key.

Two design choices stood out to researchers:

• The ransomware throttles itself, monitoring memory and CPU usage and pausing new file encryption whenever memory use exceeds 29% or CPU load climbs above 70%, allowing victims to keep using infected machines during the attack without an obvious slowdown that might tip them off.
• Larger files are only partially encrypted, with the malware scattering small 512-byte encrypted blocks throughout the file rather than processing it in full, which renders the file unusable far faster than complete encryption would.

Once encryption finishes, affected files are renamed with a victim-specific identifier and the ".dlock" extension, their icons change to a custom lock symbol, and the desktop wallpaper is replaced with a notice directing the victim to recovery instructions. A plain-text ransom note is dropped into affected folders, while the interactive HTML application described above is placed on drive roots and desktop folders.

Microsoft's report notes that the ransom demand is typically payable in Bitcoin or Monero, with payment promised to deliver a working decryptor, deletion of stolen data, an explanation of how the network was initially breached, and security recommendations for the victim going forward.

To help organizations defend against DeadLock and similar threats, Microsoft recommends a layered approach to endpoint security, including cloud-delivered antivirus protection, endpoint detection and response tools running in block mode, tamper protection to prevent attackers from disabling security software, and automated investigation and remediation features.

The company also advises enabling Controlled Folder Access to restrict unauthorized changes to sensitive directories, along with attack-surface reduction rules that block untrusted executables and limit lateral movement techniques such as those carried out through PsExec and WMI.

Beyond the technical mitigations, Microsoft's report reinforces long-standing baseline advice for organizations wary of ransomware: maintain offline and immutable backups that cannot be reached by an attacker who has already compromised the network, apply multi-factor authentication broadly, and keep a close eye on the credential-theft and lateral-movement techniques that typically precede a mass-encryption event.

Because DeadLock's pre-encryption phase spends considerable effort disabling security tooling and clearing logs, early detection during those preparatory stages offers defenders a meaningfully better chance of stopping an attack before files are locked.

The combination of blockchain-backed infrastructure and a technically mature encryption routine positions DeadLock as one of the more resilient ransomware operations currently being tracked, and researchers expect other ransomware groups to experiment with similar decentralized approaches as traditional takedown methods continue to pressure conventional criminal infrastructure.