DeadLock Ransomware

Overview

The DeadLock ransomware group has adopted a blockchain‑backed infrastructure to strengthen its resilience against law enforcement takedowns. Emerging in mid‑2025, DeadLock employs double‑extortion tactics—combining data theft/leak with file encryption—to pressure victims into paying. By July 2026, its leak site listed 80 victim organizations, primarily across Europe, spanning IT, mining, transportation, manufacturing, hospitality, and consumer goods.

Blockchain‑Powered Infrastructure

• Polygon blockchain: Stores configuration data and leak site posts.
• Smart contract queries: Victim chat apps retrieve current proxy addresses via eth_call.
• Session network: Encrypts victim communications.
• Wasabi cloud: Hosts stolen files for victim access.

This decentralized design reduces reliance on traditional domains and servers, making takedowns harder. However, Microsoft researchers note that Polygon RPC endpoints and Wasabi storage remain potential weak points.

Encryption Scheme

• Target exclusions: Avoids encrypting systems in CIS countries, Iran, Syria, Oman, and Yemen.
• System prep: Deletes backups, halts virtualization, empties Recycle Bin.
• Encryption method: Uses per‑file XChaCha20 keys protected by Curve25519 elliptic curve.
• Performance tuning: Caps usage at 29% memory and 70% CPU, allowing victims to continue using machines during encryption.
• Large file handling: Encrypts 512‑byte blocks intermittently to speed up while ensuring irrecoverability.

Encrypted files are renamed with victim identifiers, appended with .dlock, ransom notes are dropped, and desktop wallpapers are changed to signal compromise.

Ransom Demands

DeadLock requests payment in Bitcoin or Monero, offering:

• A decryptor.
• A promise to delete stolen data.
• Disclosure of the initial access vector.
• Security recommendations for the victim.

Defensive Guidance

Microsoft recommends:

• Cloud‑delivered antivirus and EDR in block mode.
• Tamper protection and automated remediation.
• Controlled Folder Access to restrict unauthorized file changes.
• Attack surface reduction rules to block PsExec and WMI lateral movement.
• Immutable backups stored offline or in separate locations.

Expert in the Cloud Insight

DeadLock’s use of blockchain and decentralized networks marks a significant evolution in ransomware resilience. By embedding infrastructure in Polygon smart contracts and encrypting communications via Session, the group reduces its exposure to traditional takedown strategies. For defenders, the lesson is clear: resilience must be matched with proactive detection, layered endpoint defenses, and strict backup hygiene.