DeadLock Ransomware Stores C2 in Polygon Smart Contracts; 80+ Orgs Hit
Microsoft: DeadLock ransomware, active since July 2025, stores C2 proxy URLs in Polygon smart contracts and rotates infrastructure. HTML ransom pages plus Session evade classic LE takedowns. 80+ victims on leak sites as of July 2026—IT, mining, transport, manufacturing, hospitality, consumer goods.
On 10 August 2026, Microsoft Threat Intelligence published a deep-dive on DeadLock ransomware architecture. Group active since July 2025. By July 2026 the leak site listed 80+ victims across Europe, Asia, the Americas, and Africa—IT, mining, transport, manufacturing, hospitality, consumer goods.
Defining trait: Polygon smart contracts store C2 proxy URLs and leak-blog content. Session plus Wasabi-compatible storage form a takedown-resistant comms stack. Classic domain/IP blocks fail at high rate.
Incident Overview
DeadLock is written in Rust. Dual extortion. Per-file encryption with Curve25519 and XChaCha20. HTML ransom page embeds E2E chat, a paginated leak blog, and a file browser—no traditional backend.
Pre-encrypt: deletes volume shadow copies, wipes event logs, kills security/backup/virtualization/cloud-sync processes. AnyDesk for remote control.
Ransom in Bitcoin or Monero. Offers decryptor, stolen-data deletion, initial-access disclosure, and hardening advice.
Technical Details
Polygon Smart Contracts as Config Store
HTML recovery page talks to two Polygon contracts via eth_call (no wallet):
- Chat-proxy contract: 0x8EF7c3e531d871D3B9D559722DE77EB1dEc19dAe, selector 0x933a9ce8 — current proxy-server URL.
- Blog contract: 0x757984507c82c8dA1d3969c535dB5706eEE6426C, selector 0xd4070542 — leak-blog titles, bodies, timestamps, image and attachment links.
Page round-robins 6 public Polygon RPC endpoints for the proxy URL. One dead endpoint does not break comms. Attacker rotates the proxy URL by updating the contract—no re-drop of victim-side pages. Domain/IP block chains are bypassed.
Session Network and Wasabi Storage
Chat rides Session (onion routing + Swarm). HTML page talks to the victim browser via the proxy. Victim identity is derived deterministically from entered credentials—no registration. Lost credentials = lost identity. Stolen files distributed via Wasabi-compatible decentralized storage; access still gated by the smart contracts.
Encryption Behavior
Encryptor self-throttles: RAM cap 29%, CPU cap 70%, directory threads = 2× CPU cores. Host stays “usable” during encryption; lowers operator detection. Per-file keys. Large files chunked for speed. Appends .dlock, swaps file icons, drops ransom note + HTML page, replaces desktop wallpaper.
Impact
Decentralized stack creates three problems for defenders and LE:
- Takedowns fail: killing one domain/IP does not cut comms; attacker rotates silently.
- Evidence wipe: VSS deleted, security processes killed, event logs cleared before encrypt—forensics starve.
- Broad sector hit: 80+ victims in critical-infrastructure-adjacent industries; cascade risk high.
Remediation
Immediate Actions
- Deploy EDR in block mode; post-compromise telemetry loss is expected.
- Enforce Microsoft vulnerable-driver blocklist via Windows Defender Application Control (WDAC) + HVCI. Blocks BYOVD.
- Offline, immutable backups are the only reliable recovery path against DeadLock encryption.
Threat-Hunting IoCs
- Encryptor SHA-256: a1fdf65020ce4a0f0940c793c6425baf8a0b994ec48b9baaf72788661a9d29f4
- Leak-site domains: deadlock.liveblog365[.]com, dlock.liveblog365[.]com, deadlockblog.great-site[.]net, deadblogdbdu5wprek7wa2o4ce7rnt6u6ntqeud3hzjjcveosgpsqqqd[.]onion, deadlockblog.medianewsonline[.]com
- Encrypted-file suffix: .dlock
- Network: watch anomalous egress to public Polygon RPC endpoints including polygon-bor-rpc.publicnode[.]com, polygon.drpc[.]org.
Sources
- Microsoft Security Blog: DeadLock ransomware deep-dive
- Cyber Security News: DeadLock IoCs and defense notes
- Windows Report: DeadLock encryption behavior and Microsoft mitigations