The DeadLock ransomware operation is using a decentralized infrastructure that relies on blockchain-backed services to protect its communication with victims and data-leak activity.

The threat actor emerged in mid-2025 and uses double-extortion tactics (data theft/leak and file encryption) to pressure victims into paying a ransom.

By July this year, DeadLock's data leak site listed 80 organizations, mostly from Europe. Victims include companies in the IT, mining, transportation, manufacturing, hospitality, and consumer goods sectors.

Microsoft researchers observed the malware being deployed by multiple groups, including an affiliate previously linked to the Lynx and INC ransomware ecosystems.

The DeadLock ransomware operators adopted a new approach that uses the Polygon blockchain to store configuration data and the posts on the leak site.

Instead of using a traditional Tor URL, the HTML page retrieves the current chat-proxy address by querying a smart contract on the Polygon blockchain through a read-only eth_call.

Retrieving command-and-control (C2) addresses stored on the blockchain is now a common tactic for cybercriminals, but it is a rare occurrence in the ransomware space.

Additionally, DeadLock uses the decentralized Session network to encrypt victim communications and provides access to stolen files hosted on the Wasabi cloud service.

All that enables the operators to replace the chat proxy without modifying the victim-facing application and reduces their dependence on conventional domains and web servers, which can be taken down by law enforcement agencies.

However, Microsoft noted that communications still require the custom proxy, public Polygon RPC endpoints must remain accessible, and files hosted on Wasabi can be removed, so resistance to disruptions isn’t absolute.

DeadLock encryption scheme

Microsoft's report also dives into DeadLock’s encryption system, which is configured to avoid countries in the former Soviet Union and the Commonwealth of Independent States (CIS) region, as well as Iran, Syria, Oman, and Yemen.

After preparing the Windows host by deleting backups, stopping virtualization, and emptying the Recycle Bin, the locker encrypts select non-system directories using unique per-file XChaCha20 keys protected with the Curve25519 elliptic curve.

The ransomware is configured to use up to 29% of the available system memory and 70% of CPU resources, so the victim may continue using the machine during the encryption process without major performance hiccups.

Larger files are intermittently encrypted using 512-byte blocks to speed up the process while still making them mostly irrecoverable.

Encrypted data is renamed with a victim-specific identifier and the ‘.dlock’ extension, the icons are changed, TXT ransom notes are dropped, and the desktop wallpaper is changed to indicate that the system has been locked.

The attacker requests ransom payments in Bitcoin or Monero in exchange for a decryptor, a promise to delete the stolen data, details about the initial access vector, and a set of security recommendations.

To defend against DeadLock ransomware attacks, Microsoft recommends strengthening endpoint defenses through cloud-delivered antivirus protection, EDR in block mode, tamper protection, automated investigation and remediation, and automatic attack disruption.

Organizations should also restrict unauthorized file changes using Controlled Folder Access and enable attack-surface reduction rules to block untrusted executables and lateral movement via PsExec and WMI.

Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.

The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.

Get the report