cyber.hendryadrian.com
Threat Research · bleepingcomputer.com

DeadLock ransomware uses blockchain to make infrastructure harder to disrupt

· Original article ↗

Summary

Microsoft says the DeadLock ransomware operation uses Polygon smart contracts, Session and Wasabi to manage victim communications and data leaks, complicating takedowns. Its report details encryption behavior and recommends endpoint and attack-surface defenses.

Key points

  • Microsoft researchers say DeadLock, active since mid-2025, uses double extortion and had listed 80 organizations by July.
  • The operation stores configuration data and leak-site posts on Polygon; its chat app queries a smart contract for the current proxy address.
  • DeadLock uses Session for victim communications and hosts stolen files on Wasabi; Microsoft says these dependencies mean disruption resistance is not absolute.
  • Microsoft observed the malware deployed by multiple groups, including an affiliate previously linked to the Lynx and INC ransomware ecosystems.
  • The locker uses per-file XChaCha20 keys protected with Curve25519 and intermittently encrypts larger files in 512-byte blocks.
  • Microsoft recommends endpoint protections, Controlled Folder Access and attack-surface reduction rules to help defend against the threat.

Article Details

Attack Vectors
  • DeadLock uses double extortion, stealing data and encrypting files to pressure victims into paying.
  • The victim-facing chat page queries a Polygon smart contract through a read-only eth_call to retrieve the current chat-proxy address.
  • DeadLock uses the Session network for encrypted communications with victims and Wasabi cloud storage to host stolen files.
  • Before encrypting files on Windows hosts, the ransomware deletes backups and stops virtualization.
Defensive Notes
  • Microsoft recommends cloud-delivered antivirus protection, EDR in block mode, tamper protection, automated investigation and remediation, and automatic attack disruption.
  • Microsoft recommends Controlled Folder Access and attack-surface reduction rules to block untrusted executables and lateral movement via PsExec and WMI.

MITRE ATT&CK

T1102.001 · Dead Drop ResolverDeadLock stores chat-proxy address data on the Polygon blockchain, which the victim-facing page queries to retrieve the current address.T1486 · Data Encrypted for ImpactDeadLock encrypts selected non-system directories using unique per-file XChaCha20 keys.T1490 · Inhibit System RecoveryDeadLock deletes backups before encrypting files.T1567.002 · Exfiltration to Cloud StorageDeadLock makes stolen files available to victims through Wasabi cloud storage.T1573 · Encrypted ChannelDeadLock uses the Session network to encrypt communications with victims.

Threat Actors

DeadlockA ransomware operation reported to use double extortion, stealing data and encrypting files. Microsoft researchers observed the malware being deployed by multiple groups, including an affiliate previously linked to the Lynx and INC ransomware ecosystems.

Malware

DeadLockDeadLock ransomware uses a decentralized setup with the Polygon blockchain, the Session network, and Wasabi cloud storage to hide its communication and data-leak operations.

Vendors

MicrosoftMicrosoft says the group, active since mid-2025, has already listed 80 victims and relies on double extortion to pressure organizations into paying.

Products

Microsoft WindowsAfter preparing the Windows host by deleting backups, stopping virtualization, and emptying the Recycle Bin, the locker encrypts select non-system directories using unique per-file XChaCha20 keys protected with thePolygonDeadLock ransomware uses a decentralized setup with the Polygon blockchain, the Session network, and Wasabi cloud storage to hide its communication and data-leak operations.SessionDeadLock ransomware uses a decentralized setup with the Polygon blockchain, the Session network, and Wasabi cloud storage to hide its communication and data-leak operations.WasabiDeadLock ransomware uses a decentralized setup with the Polygon blockchain, the Session network, and Wasabi cloud storage to hide its communication and data-leak operations.

Countries

Irancountries in the former Soviet Union and the Commonwealth of Independent States (CIS) region, as well as Iran, Syria, Oman, and Yemen.Omanthe former Soviet Union and the Commonwealth of Independent States (CIS) region, as well as Iran, Syria, Oman, and Yemen.Syriain the former Soviet Union and the Commonwealth of Independent States (CIS) region, as well as Iran, Syria, Oman, and Yemen.YemenSoviet Union and the Commonwealth of Independent States (CIS) region, as well as Iran, Syria, Oman, and Yemen.

Industries

consumer goodsVictims include companies in the IT, mining,  transportation, manufacturing, hospitality, and consumer goods sectors.HospitalityVictims include companies in the IT, mining,  transportation, manufacturing, hospitality, and consumer goods sectors.ITIt uses double extortion by stealing data and encrypting files.ManufacturingVictims include companies in the IT, mining,  transportation, manufacturing, hospitality, and consumer goods sectors.MiningVictims include companies in the IT, mining,  transportation, manufacturing, hospitality, and consumer goods sectors.TransportationVictims include companies in the IT, mining,  transportation, manufacturing, hospitality, and consumer goods sectors.

Related Articles