DeadLock Ransomware Moves C2 to Polygon Blockchain, Evading…

Microsoft Threat Intelligence published a full technical analysis on August 11, 2026, detailing DeadLock, a ransomware group active since July 2025 that has claimed 96 victims across Italy, Spain, Poland, Turkey, and the U.S. The research documents the first enterprise-scale use of Polygon smart contracts to host command-and-control addresses and a data leak blog, making infrastructure immutable to law enforcement and freely readable by victims.

Key Takeaways

DeadLock uses two identified Polygon wallets—0x8EF7c3e531d871D3B9D559722DE77EB1dEc19dAe for C2 proxies and 0x757984507c82c8dA1d3969c535dB5706eEE6426C for data leak blog posts—storing addresses and content on-chain instead of on servers.
The recovery HTML delivered to victims executes JavaScript that performs read-only eth_call queries to the contract to fetch the current proxy address: zero gas cost, no on-chain transaction to trace forensically.
The Rust-based encryptor employs a hybrid XChaCha20 scheme with Curve25519 and a per-file ephemeral key; Microsoft states no practical cryptographic recovery path exists without the attacker's private key.
The group integrates BYOVD—Bring Your Own Vulnerable Driver—exploiting CVE-2024-51324 in the Baidu Antivirus driver to terminate EDR processes, with geofencing that triggers self-deletion on systems with CIS-region and Persian languages.

How Blockchain Indirection Works: No Server to Seize

The core mechanism is an addressing layer that replaces DNS, CDNs, and web servers with the public blockchain. The RECOVERY_CHAT.<UID>.html file—a single-page web application delivered to the victim post-encryption—contains JavaScript that queries the Polygon smart contract at address 0x8EF7c3e531d871D3B9D559722DE77EB1dDec19dAe. The eth_call, being read-only, requires no gas and generates no on-chain transaction. It simply returns the current proxy URL, documented at the time as 138.226.236[.]51/prrq.php.

The DeadLock operator updates the proxy with a standard on-chain transaction—paying gas in MATIC—and all subsequent victims automatically read the new address. No centralized point of failure exists: no registrar to pressure, no hosting provider to notify, no domain to sinkhole. The data leak blog follows the same logic, with content hosted on Polygon and accessible via the Wasabi protocol, which enables browsing without a traditional web server.

Microsoft Threat Intelligence framed the problem in operational terms: "This infrastructure model represents a meaningful evolution from traditional ransomware communication channels and poses new challenges for takedown efforts." The quote appears in the August 10, 2026 report.

"DeadLock is the first financially motivated ransomware operation to use the technique as the core of a functioning double-extortion campaign against real enterprise targets at documented scale" — TechTimes/ReliaQuest, citing Microsoft and Group-IB research

The Historical Path: From EtherHiding to the DeadLock Model

Group-IB first documented DeadLock's use of EtherHiding in January 2026, with contracts created and updated as early as August and November 2025. The technique—previously observed in Lazarus APT campaigns and the Aeternum botnet—involves obscuring malicious payloads inside blockchain transactions. DeadLock, however, turned it into something qualitatively different: not mere payload hosting, but persistent operational infrastructure for a double-extortion model.

ReliaQuest identified DeadLock as the most technically significant emerging group in Q2 2026. Cisco Talos associated the group with compressed attack timelines—roughly five days from initial compromise to encryption—and sophisticated encryption. Victim counts converge across sources: TechTimes reported "80+" victims on the leak site as of July 2026, BleepingComputer confirmed "80 victims" in the same period, while Microsoft Threat Intelligence updated the count to 96 claims in August 2026. The growth aligns with activity documented from May 2026, when DeadLock appeared on Ransomware.Live.

The Rust Encryptor: Cryptographic Architecture and Anti-Analysis Countermeasures

TechTimes' technical analysis, consistent with the Microsoft report, details the cryptographic implementation. For each target file, the malware generates a random 32-byte key and 24-byte nonce for XChaCha20. It then creates an ephemeral Curve25519 key pair, encapsulates the file key via the NaCl project's crypto_box, and appends the ciphertext to the original file. This scheme eliminates any mathematical shortcut: according to Microsoft Threat Intelligence, "there is no mathematical shortcut to decryption without the attacker's private key."

The encryptor also implements selective throttling: it suspends operation if it detects memory usage above 29% or CPU above 70%, likely to evade resource-spike detections. For files under 50 MB it performs full encryption; for larger files it adopts intermittent 512-byte chunks, preserving partial content readability without compromising structural irrecoverability.

The BYOVD mechanism exploits CVE-2024-51324—a vulnerability in the Baidu Antivirus driver rated CVSS 3.8 LOW by NVD—to terminate EDR processes. The vector requires elevated privileges, indicating the operator already holds administrative access at execution time.

Immediate Defensive Actions

The DeadLock model forces a redesign of detection and response strategies. The following recommendations derive directly from the techniques documented in primary sources.

Monitor eth_call queries to suspicious smart contract addresses: Read-only queries to known wallets such as 0x8EF7c3e531d871D3B9D559722DE77EB1dDec19dAe should trigger alerts in web proxy or network monitoring, as they indicate contact with DeadLock infrastructure.
Analyze post-encryption HTML artifacts: The RECOVERY_CHAT.<UID>.html file is a complete application with embedded JavaScript, E2E chat via Session, and blockchain logic; its hash and network connections are highly specific indicators of compromise.
Restrict installation of decentralized messengers like Session: The source documents Session's use as a parallel victim communication channel; controlling its enterprise installation and use reduces the contact surface.
Check for the Baidu Antivirus driver and anomalous EDR process terminations: CVE-2024-51324 is documented as an active BYOVD vulnerability; detection of the driver or unusual EDR process terminations warrants immediate investigation.

The Decentralization Paradox: A Double-Edged Sword

The Polygon blockchain functions exactly as designed: immutability, censorship resistance, permissionless access. These properties, developed to eliminate trusted intermediaries, become in the DeadLock model the crime's own trusted intermediary. Neither primary nor contextual sources indicate that Polygon Labs or cryptocurrency exchanges have enacted freezing countermeasures on the identified wallets.

The transition from experimental EtherHiding to enterprise-grade operational infrastructure opens a trajectory other groups will likely follow. Cry0 is already cited in sources as a group with a similar template. By late 2026, blockchain-native ransomware may no longer be an anomaly but a market segment.

The dossier does not identify conclusive initial access vectors, does not determine operator identity, and does not quantify collected ransoms. No infrastructural overlap links DeadLock to Lazarus or North Korean APTs: technical similarities with EtherHiding do not constitute attribution.

Information verified against cited sources and current as of publication.

Sources

Sources and references

Get DeafLetter