DeadLock Leverages Polygon and Session for Takedown-Resistant…

Microsoft Threat Intelligence dissects DeadLock, a Rust-based ransomware that has compromised over 80 organizations since July 2025, with more than half of victims in Europe. The group uses the Polygon blockchain and Session messaging network to eliminate traditional single points of failure, rendering conventional law enforcement takedowns ineffective.

Microsoft Threat Intelligence has published a technical analysis of DeadLock, a Rust-based ransomware that has compromised more than 80 organizations since July 2025, with over half of the victims concentrated in Europe. The group distinguishes itself by adopting decentralized protocols—the Polygon blockchain and the Session messaging network—which eliminate the traditional single points of failure in criminal infrastructure. This architecture renders classic law enforcement interventions such as server seizures or domain takedowns ineffective, turning decentralization from a tool of liberty into an instrument for crime.

Key Takeaways

DeadLock employs Session and Polygon for communications and extortion resource hosting, eliminating centralized servers recoverable by authorities.
The Rust encryptor implements linguistic geofencing with 17 excluded LANGIDs and resource-aware throttling with thresholds at 29% memory usage and 30% CPU idle.
The hybrid Curve25519/XChaCha20 cryptographic scheme includes an attacker public key in compressed SEC1 format, a deliberate tradecraft marker.
More than half of the 80+ victims are in Europe; the malware is distributed by affiliates of known groups such as Lynx and INC ransomware.

Rust as an Anti-Analysis Foundation

DeadLock is developed in Rust for efficiency, memory safety, and cross-platform flexibility. The language choice is not aesthetic: native compilation and the absence of a typical managed-language runtime make static and dynamic analysis more laborious for security operators. The encryptor implements a hybrid cryptographic scheme combining Curve25519 for key exchange with XChaCha20 for file encryption, following the NaCl constructions documented in the independent analysis by SOC Fortress. Each encrypted file includes a 33-byte ephemeral public key and decryption parameters in its footer.

A technical detail signals refined tradecraft: the attacker's public key is encoded in compressed SEC1 format with a 0x03 prefix, non-standard for Curve25519. This choice is a deliberate marker distinguishing DeadLock from more generic implementations. The embedded configuration is protected by an 8-byte XOR key, while the encryption policy is tiered based on file size, defined in a parsable configuration string.

The Decentralized Triad: Session, Polygon, and Takedown Resilience

DeadLock's architectural innovation lies in a recovery ecosystem combining three complementary layers. The first is Session, an onion-routed messaging network without centralized servers, used for victim communications. The second is Polygon, a blockchain used for storage and delivery of resources used in extortion. The third is the absence itself of proprietary centralized infrastructure: there is no C2 server to seize, no leak site domain to block, no negotiation email address to filter.

"This architecture increases the resilience of portions of the communication, leak hosting, and negotiation infrastructure, allowing DeadLock operators to recover from some disruption efforts while maintaining continuity for victims."
— Microsoft Threat Intelligence

According to SOC Fortress analysis, decentralized protocols are "specifically engineered to ensure operational continuity even in the face of infrastructure seizures or domain takedowns." Microsoft's formulation is more cautious on the degree of resilience, limiting it to portions of the infrastructure; both sources agree, however, on the strategic direction. The source does not specify whether Polygon hosts only static content or also active smart contract logic, nor whether Session is used exclusively for post-encryption negotiation chat or also for preliminary command and control.

Behavioral and Geographic Evasion

DeadLock integrates two evasion mechanisms that reduce sandbox visibility and increase attack precision. Linguistic geofencing checks the system and UI LANGID: if it matches one of 17 excluded codes—predominantly former CIS and Middle Eastern countries—the malware immediately self-deletes without executing any encryption. This pattern is commonly observed among ransomware operators believed to be active in those regions, but does not constitute proof of geographic origin.

Resource-aware throttling continuously monitors memory and CPU. If memory usage exceeds 29% or CPU idle drops below 30%, the malware activates a waitable timer that suspends activity. The mechanism employs atomic signaling: worker threads engaged in encrypting a file are not interrupted, preserving the integrity of the in-progress process. The dossier does not clarify whether this behavior is designed primarily for sandbox evasion, to preserve the stability of the compromised system, or for both objectives.

Escalation, Defense Neutralization, and Forensic Destruction

The encryptor implements a UAC bypass via a randomly named 8-character uppercase .cmd script, executed with ShellExecuteW and the RunAs verb, with a maximum of 10 elevation attempts. Once privileges are obtained, it acquires SeDebugPrivilege, SeRestorePrivilege, SeBackupPrivilege, SeTakeOwnershipPrivilege, SeAuditPrivilege, and SeSecurityPrivilege to operate without restrictions.

Defense neutralization is systematic: it terminates Windows Defender, VSS and backup services, cloud sync services, EDR processes, and remote access tools. Forensic destruction proceeds at three levels: direct log clearing, registry-based disabling of WINEVT channels, and enumeration through the modern wevtapi.dll APIs. Visual branding includes a custom .dlock icon dropped in C:\ProgramData with a registry modification, a rare element signaling attention to victim perception.

What to Do Now

Organizations must adapt defenses to DeadLock's distributed nature. Security teams should integrate monitoring of traffic to Polygon RPC endpoints and Session nodes within the corporate network, activity not covered by traditional signatures. Detection must focus on pre-encryption behaviors: the UAC bypass with random 8-character .cmd scripts, the sequential acquisition of the six documented system privileges, and the termination of VSS and EDR services.

Forensic analysts should verify the presence of the .dlock icon in C:\ProgramData and modifications to WINEVT channels, specific indicators of compromise for this encryptor. Network segmentation must isolate critical systems to slow propagation, given that throttling at 29% memory and 30% CPU idle can mask initial activity. Backups must be tested for recovery without reliance on negotiation channels, which on Session are not interceptable by conventional methods.

The geofencing with 17 excluded LANGIDs is not directly relevant for defense, but confirms that DeadLock is distributed by affiliates with controlled targeting. European organizations, representing over 50% of the 80+ documented victims, must consider this elevated risk profile in threat intelligence assessments.

Why It Matters

DeadLock represents a qualitative leap in the professionalization of ransomware. The adoption of Rust and the Web3 stack is not a technology fad: it raises the barriers to entry for security analysts, who must master reverse engineering tools for native binaries and trace flows on decentralized infrastructures. The source does not quantify the exact number of affiliates nor their revenue-sharing structure; it also does not document the methods of initial data exfiltration prior to encryption.

The European concentration of victims—over 50% of a total exceeding 80 organizations—indicates active geographic targeting. The double extortion model, with the threat of data publication alongside encryption, is now standard but here is paired with a negotiation infrastructure that is harder to disrupt. The source does not specify particular corrective measures or mitigations; the brief also does not document whether victims have actually recovered data through the proposed recovery channels.

The most significant datum for the industry is the convergence: tools designed for freedom of expression and censorship resistance—Session as an evolution of Signal, Polygon as Ethereum scaling—are repurposed to guarantee the operational continuity of criminal activities. It is not the first time legitimate technologies have been weaponized, but the architectural coherence with which DeadLock integrates them signals a deep understanding of the structural advantages of decentralization, not a superficial adoption.

Questions and Details

Is Polygon Compromised or Vulnerable?

No. Polygon is used legitimately as infrastructure; there is no indication that the blockchain or its smart contracts present exploited vulnerabilities. Decentralization itself is the resilience vector, not a security defect.

Does Geofencing Prove the Operators Are Russian?

No. Linguistic geofencing is described by Microsoft as "commonly observed among ransomware operators believed to operate from those regions." It is a behavioral indicator, not proof of attribution.

Does Throttling Guarantee the Integrity of Encrypted Files?

In the analyzed sample, atomic signaling preserves active worker threads during pauses. The source does not extend this guarantee to all execution scenarios.

Information is based on the cited source and current as of publication.

Sources

Sources and references