DeadLock: The Ransomware Using Polygon to Evade Infrastructure…

DeadLock leverages Polygon smart contracts to rotate proxy servers and host its data leak site, rendering the infrastructure-seizure strategy that dismantled LockBit and ALPHV largely ineffective.

Microsoft Threat Intelligence published its most detailed technical analysis of the DeadLock group on August 10, 2026, documenting an operational leap that redefines the terms of ransomware defense. Its extortion campaigns — 96 claimed victims at the time of the report, concentrated in Italy, Spain, Poland, Turkey, and the United States — stand out not only for cryptographic quality or behavioral evasion, but for the use of Polygon smart contracts as the backbone of command, control, and stolen-data publication. This choice renders a tactic that law enforcement has used successfully against LockBit, ALPHV, and others virtually useless: server seizure.

Key Takeaways

DeadLock uses Polygon smart contracts to store proxy URLs and data leak blog posts, making its infrastructure resistant to traditional seizures and takedowns.
The HTML recovery application performs read-only eth_call queries against public RPC endpoints without requiring a wallet or paying gas, allowing victims to contact operators without leaving on-chain traces.
The Rust encryptor implements hybrid Curve25519/XChaCha20 encryption with per-file ephemeral keys, and Microsoft states there is no mathematical shortcut to decryption without the attacker's private key.
The group employs BYOVD techniques exploiting CVE-2024-51324 in the Baidu Antivirus driver (BdApiUtil.sys) to terminate EDR systems at the kernel level.

How Polygon Becomes the Backbone of an Extortion Operation

The infrastructural novelty of DeadLock lies in an architecture that replaces seizable servers with decentralized components. According to Microsoft's analysis, the group uses two specific wallet addresses: 0x8EF7c3e531d871D3B9D559722DE77EB1dEc19dAe, which stores the command-and-control proxy server URL (documented in the report as 138.226.236[.]51/prrq.php), and 0x757984507c82c8dA1d3969c535dB5706eEE6426C, designated for publishing data leak blog posts.

The victim recovery mechanism runs through an HTML file named RECOVERY_CHAT.<UID>.html, described by Microsoft as "a self-contained interactive web application that implements end-to-end encrypted chat, a paginated data leak blog, and a file browser, all without requiring a traditional backend server." The embedded JavaScript executes read-only eth_call queries against six public Polygon RPC endpoints. No wallet is required, no transaction is created, no fee is paid: the victim retrieves the current proxy address leaving a minimal and technically non-attributable trace.

This technique, dubbed EtherHiding, is not original to DeadLock. Group-IB documented its use as early as August 2025 for the group's first smart contracts, with subsequent updates in November 2025, and earlier samples had been linked to a botnet named Aeternum and operators attributed to North Korea. DeadLock represents, however, the first systematic application as the core of an enterprise-targeted double-extortion campaign, as reported by TechTimes based on the Microsoft analysis.

"DeadLock, in other words, is not just a threat. It is a template" — ReliaQuest assessment, Q2 2026

The Encryptor as Proof of Engineering Maturity

The encryption component, written in Rust, confirms a level of technical care unusual in the ransomware landscape. The hybrid cryptographic implementation combines Curve25519 for elliptic-curve Diffie-Hellman key exchange, XChaCha20 as the stream cipher, and NaCl crypto_box (XSalsa20/Poly1305) for authentication. Microsoft documented a 32-byte ephemeral key and a 24-byte nonce generated for every single file, eliminating any reuse of cryptographic material. The company's explicit statement is unequivocal: "There is no mathematical shortcut to decryption without the attacker's private key."

The encryption strategy is hierarchical and resource-aware: files under 50 MB undergo full encryption; at approximately 50 MB, 50% of content is encrypted; at approximately 118 MB, 25%; at approximately 500 MB, 10%; above 1 GB, a 512-byte block encryption with an intermittent pattern is applied. Simultaneously, the malware suspends activity when memory exceeds 29% or CPU exceeds 70%, reducing its detectable behavioral profile. Geofencing also excludes CIS-language countries, Iran, Syria, Oman, and Yemen, suggesting operational caution that does not, however, constitute proof of geographic origin.

The Attack Chain: From BYOVD to Monitoring Evasion

Initial access leverages a Bring Your Own Vulnerable Driver technique documented by Cisco Talos in December 2025. DeadLock exploits CVE-2024-51324, with a CVSS 3.8 score classified as LOW by the National Vulnerability Database, in a legitimate Baidu Antivirus driver (BdApiUtil.sys). The vulnerability allows termination of Endpoint Detection and Response processes at the kernel level, stripping the victim of detection and response capability before the encryptor begins its operation. The choice of a security driver from a non-Western vendor illustrates a widespread but effective abuse pattern: protective software becomes the vehicle for its own neutralization.

Infrastructure funding is equally structured. Group-IB traced the operational wallet's replenishment through FixedFloat, an instant exchange enabling cryptocurrency conversions without prolonged registration. This detail, dated January 2026, shows operational continuity predating the Microsoft analysis by months.

What to Do Now

Review network blocking policies: DeadLock's proxy addresses rotate via Polygon smart contracts, making IP blocklists and traditional DNS filters incomplete as a sole defensive line.
Strengthen driver process monitoring: The signature of BdApiUtil.sys or analogous drivers from non-Western security vendors must trigger immediate verification, regardless of the vendor's general reputation.
Isolate backups from automatic cloud synchronization: DeadLock terminates cloud sync services and deletes shadow copies; maintaining offline, air-gapped copies reduces the destruction surface.
Assess the cryptographic resilience of your backup strategies: The quality of encryption implemented by DeadLock makes recovery without ransom payment unlikely, shifting the defensive center of gravity to the availability of protected data.

Why DeadLock Changes the Game Against Ransomware

The problem DeadLock presents to defenses is not merely technical but architectural. International disruption operations in recent years — Operation Cronos against LockBit, actions against ALPHV/BlackCat — have relied on the ability to identify, seize, and disincentivize hosting, proxy, and communication infrastructure. When that infrastructure migrates to immutable smart contracts and decentralized storage protocols like Wasabi, seizure becomes an operation of limited meaning: the contracts persist, the data remains accessible, and proxy address rotation requires only an on-chain transaction.

Microsoft itself acknowledges the limits of its disruption tactics, noting that "proxy servers and Wasabi storage remain disruptable." The challenge, however, lies in scale and speed: every takedown requires transnational cooperation, while creating a new smart contract on Polygon takes minutes and fractions of a MATIC token. The analogy proposed by ReliaQuest — DeadLock as a "template" rather than an isolated threat — finds confirmation in the emergence of Cry0, a second ransomware group experimenting with blockchain-based C2 infrastructure, and in ReliaQuest's own prediction of further adoption by year-end.

For organizations, this means the defensive perimeter must extend beyond the traditional network. An attacker's ability to host extortion resources on infrastructure that cannot be shut down with a seizure warrant forces a rethinking of operational assumptions: the premise that a threat can be "disconnected" becomes progressively unsustainable.

Frequently Asked Questions

Does paying the ransom guarantee data recovery?: The dossier neither documents nor confirms or denies post-payment decryption capability. The reliability of "security report promises" and future protections cited in the recovery message is not verifiable based on available sources.
Can authorities block DeadLock's smart contracts?: The Polygon network is decentralized; validators lack centralized mechanisms for contract censorship. Microsoft documents no attempts at intervention at the foundation or validation level, nor confirms such attempts would be technically effective.
Why is the Microsoft analysis significant now?: After a year of documented operation starting July 2025, DeadLock had accumulated sufficient scale (80-96 victims according to various sources) and technical complexity to warrant systematic treatment. The August 10, 2026 report provides the first complete snapshot of a model researchers had only partially observed.

Sources

Information verified against cited sources and current as of publication.

Sources

Sources and references