DeadLock is the name of a ransomware group that uses noticeably decentralized techniques to approach victims and publish stolen data. According to Microsoft Threat Intelligence, the group combines a messaging service with blockchain-supported components to retrieve and deliver the sources needed during the extortion process. What stands out most is that the DeadLock Polygon smart contracts are used to make the communication and leak infrastructure smarter.
What does this mean for organizations that may be affected? In this article, we lay out the core of the observations: how the mechanism works, what traces and behaviors you can expect, and how to align your defenses with them.
Why DeadLock relies on decentralized communication
Ransomware is not only about encrypting files. The real pressure arises when attackers communicate with victims and make the promise of a data leak feel credible. DeadLock appears to have designed this process explicitly to improve operational resilience.
Microsoft describes how the “recovery ecosystem” works alongside Session messaging and blockchain-based services. This blockchain layer helps deliver the components used during the extortion process. In practice, this means less dependence on a single centralized platform that can be taken offline easily.
DeadLock Polygon smart contracts as a resilience layer
One of the most striking elements is the way the ransomware can roll over a chain of proxy addresses. Instead of relying on a single fixed domain or server, the approach runs through Polygon smart contracts.
The core idea: the HTML recovery page that DeadLock dropped includes JavaScript that allows addresses for a decentralized proxy server to be rotated. These proxy addresses are managed via smart contracts, so the operator can change the proxy URL without having to tinker directly with domains or domain registrations. Group-IB compared this to a method where attackers effectively can generate an unlimited number of variants of their infrastructure.
This shifts the challenge for defenders. Even if a proxy or hosting location is temporarily shut down, the attacker can switch relatively quickly to new addresses updated through the blockchain.
More than chat: data leaks through the same decentralized approach
The recovery chat is not just a messaging screen. Based on analyses, the page functions as an interactive web application: end-to-end encrypted chat, a blog-like presentation of leaked data, and a file browser. Notably, the application can run as a single-page application without a traditional backend server.
For the leak blog, an approach is mentioned in which content is made accessible through blockchain components. The details fit the idea that as an attacker you want to offer victims a “readable” path without having to manage a web server that’s easy to block. This also increases the likelihood that pressure on the victim continues.
What behavior does DeadLock show on an infected system?
Besides the decentralized infrastructure, Microsoft reports characteristics of the malware itself. DeadLock uses double extortion: it encrypts files and simultaneously applies pressure by threatening to make exfiltrated data public. Observations mention that files are encrypted with the extension .dlock.
The visual impact on the system is typical as well: icons are altered using an additional .ico file written to disk, and the wallpaper is changed with a message intended to guide victims through the recovery steps.
The recovery communication is then delivered via a separate HTML file that reappears as a “RECOVERY_CHAT” page in multiple locations, including the root of drives and on the desktop.
Selective encryption and efficient execution
DeadLock uses a selective encryption model: certain folders, file types, and file names are kept outside the encryption process. In addition, the malware combines cryptography in a hybrid design, pairing Curve25519 elliptic-curve cryptography with the XChaCha20 stream cipher for file encryption.
It is also described that the ransomware monitors system response while encrypting. There is a “resource-aware throttling mechanism” that pauses when memory load rises above a threshold or when CPU load increases too much. This keeps the process manageable and reduces the chance that the environment crashes prematurely.
For incident response teams, this is relevant: the process may therefore appear to run longer—or “more calmly”—than you would expect from fast encryptor ransomware.
Anti-forensics: wiping logs and disabling logging
To make detection and forensic investigation harder, Microsoft reports that DeadLock systematically wipes logs and disables logging via registry manipulation. The goal is to prevent future events from being recorded.
Volume Shadow Copies are also removed. This makes it more difficult to recover files through restore points or to conduct investigations using snapshots.
Automation and remote access: PowerShell and AnyDesk
The Windows variant would use a PowerShell script to stop services that are not included in an allowlist. In addition, the script would ensure that those stopped services are not automatically restarted after a reboot.
For remote control, AnyDesk is mentioned as part of the approach. In a ransomware context, that’s a warning sign to check whether remote management sessions may have taken place during or around the encryption process.
Handling ransomware safely: what can you do right now?
The decentralized infrastructure using DeadLock Polygon smart contracts makes it harder to “shut down” communication and leak hosting. Still, there are steps your organization can take to reduce the likelihood and impact of damage.
1) Strengthen detection around file changes
Because DeadLock encrypts files and changes icons and wallpapers, your alerting can focus on large-scale file operations, new or unusual extensions such as .dlock, and graphical changes on endpoints. The creation of “recovery chat” HTML files can also be a signal.
2) Limit and monitor remote tools
If AnyDesk is mentioned in the threat analysis, it’s wise to regulate remote access strictly: who can log in, from where, and what the policy is regarding permissions and logging. Combine this with detection for atypical sessions during peak hours or outside normal access times.
3) Prepare incident response for double extortion
Double extortion means you’re dealing with more than encryption. Make sure you can quickly assess data leak risks: what has been exfiltrated, which systems were impacted, and how you limit further spread. Also plan communication with stakeholders and legal considerations in advance.
4) Update recovery and logging strategies
Because of anti-forensics (wiping logs, disabling logging, removing shadow copies), your recovery and monitoring shouldn’t rely entirely on a single log source. Inventory what telemetry you have, where it goes, and how you can recover if local logging becomes unusable.
Related points of attention: extortion and patch discipline
Ransomware often follows opportunities created by weaknesses or misconfigurations. If you want to look at examples of how attackers exploit vulnerabilities to get inside systems, these are relevant reading paths:
Although these topics are not specifically about DeadLock, they help address broader causes of incidents—ranging from process control to preventing quick, risky changes.
Conclusion
DeadLock shows that ransomware is evolving toward more resilient infrastructures. While classic campaigns often rely on a single communication channel, DeadLock uses a decentralized recovery page and Polygon smart contracts to rotate proxy addresses. As a result, extortion infrastructure is harder to disrupt, and pressure on victims can last longer.
For defenders, the focus now is on two areas: technology that makes encryption and recovery channels visible, and incident response that takes double extortion and anti-forensics into account. With that combination, you reduce the impact—even when attackers make their infrastructure smarter than before.
Source: https://thehackernews.com/2026/08/deadlock-ransomware-uses-polygon-smart.html
