The DeadLock ransomware exploits Polygon smart contracts to evade detection

Source: Yellow Original Title: The DeadLock Ransomware Exploits Polygon Smart Contracts to Evade Detection

Original Link: A newly discovered strain of ransomware is using blockchain technology as a weapon to build a resilient command and control infrastructure that security teams find difficult to dismantle.

Cybersecurity researchers discovered on Thursday that the DeadLock ransomware, first identified in July 2025, stores proxy server addresses within Polygon smart contracts.

This technique allows operators to continuously rotate the connection points between victims and attackers, rendering traditional blocking methods ineffective.

Despite its technical sophistication, DeadLock has maintained an unusually low profile: it operates without an affiliate program or a public data leak site.

What Makes DeadLock Different

Unlike typical ransomware gangs that publicly shame victims, DeadLock threatens to sell stolen data on underground markets.

The malware embeds JavaScript code within HTML files that communicate with smart contracts on the Polygon network.

These contracts function as decentralized repositories of proxy addresses, which the malware retrieves through read-only calls to the blockchain that do not incur transaction fees.

Researchers identified at least three variants of DeadLock, with the latest versions incorporating encrypted messaging via Session for direct communication with victims.

Why Blockchain-Based Attacks Matter

This approach reflects similar techniques documented by threat intelligence groups after observing state actors using analogous methods.

Exploiting smart contracts to deliver proxy addresses is an interesting method in which attackers can literally apply infinite variants of this technique.

Infrastructure stored on the blockchain is difficult to eliminate because decentralized records cannot be seized or disconnected like traditional servers.

DeadLock infections rename files with the “.dlock” extension and deploy PowerShell scripts to disable Windows services and delete shadow copies.

It is reported that previous attacks exploited vulnerabilities in antivirus software and used “bring-your-own-vulnerable-driver” techniques to terminate detection processes on endpoints.

Researchers acknowledge that there are still gaps in understanding DeadLock’s initial access methods and entire attack chain, although they confirmed that the group recently reactivated operations with new proxy infrastructure.

The adoption of this technique by both state actors and financially motivated cybercriminals indicates a concerning evolution in how adversaries leverage blockchain resilience for malicious purposes.