A ransomware gang that has quietly breached more than 80 organizations across four continents has done something security researchers say no financially motivated group had pulled off before: it moved its command-and-control infrastructure onto a public blockchain, making the backbone of its extortion operation effectively immune to the law-enforcement takedowns that have disrupted rival groups for years. Microsoft Threat Intelligence confirmed this in a detailed technical breakdown of DeadLock published on August 10.
Microsoft Threat Intelligence published that breakdown on August 10, covering the group’s Rust-based encryptor, its cryptographic design, and the novel post-encryption ecosystem it has built around Polygon smart contracts, the decentralized Session messaging network, and Wasabi cloud object storage. The report is one of the most granular public analyses of an active ransomware family in recent memory — and the picture it draws is not reassuring.
Security firm ReliaQuest, which flagged DeadLock as Q2 2026’s most technically significant emerging group in its July 16 quarterly ransomware report, went further than Microsoft on one point: with at least one other ransomware brand (Cry0) already experimenting with blockchain-based command-and-control, analysts there assessed it likely that additional groups will adopt smart-contract infrastructure before year’s end. DeadLock, in other words, is not just a threat. It is a template.
How Blockchain Became Criminal Infrastructure
Traditional ransomware groups maintain dark-web leak sites and negotiation portals. These are resilient by design, but they have one structural weakness: a physical or virtual host exists somewhere, and that host can be seized, suspended, or compelled offline by a hosting provider. Law enforcement and industry partners have used this chokepoint to disrupt several high-profile ransomware operations in recent years.
DeadLock routes around it using the Polygon blockchain.
Two smart contracts — one storing the current proxy server URL, one storing the group’s blog posts and data leak content — serve as censorship-resistant blockchain infrastructure. When an infected machine needs to reach DeadLock’s operators, the embedded HTML recovery chat application issues a read-only call — known in blockchain terminology as an eth_call — to one of six public Polygon RPC endpoints. No wallet is required. No transaction is created. No fees are incurred. The current proxy address comes back as data.
When operators want to change the proxy address, they send a transaction modifying the smart contract. The next infected machine that checks in reads the new address. No domain needs to be re-registered. No DNS records need updating. No hosting provider can be called. From a defender’s perspective, there is no central server to seize. The contract address itself is the infrastructure, and it lives on a public, decentralized ledger replicated across thousands of nodes worldwide.
This technique — storing malicious configuration data in blockchain smart contracts — is called EtherHiding by the research community, and it predates DeadLock. North Korean-linked threat actors used Ethereum smart contracts for similar purposes in 2024, and a botnet called Aeternum, documented by Unit 42, adopted Polygon smart contracts for full command-and-control operations. But DeadLock is the first financially motivated ransomware operation to use the technique as the core of a functioning double-extortion campaign against real enterprise targets at documented scale.
Microsoft’s report acknowledges that the architecture, while significantly harder to disrupt than a traditional dark-web site, is not invincible. The proxy server and its associated infrastructure remain dependencies. Images and files can be removed from Wasabi cloud storage. But the ability to update the proxy address on-chain, combined with decentralized messaging via Session, means disrupting any single component leaves the core extortion pipeline largely intact.
Victims Cannot Recover Without Paying
What protects DeadLock’s communications also protects its encryption. Microsoft’s analysis of the encryptor — written in Rust, a language increasingly favored by threat actors for its performance, memory safety, and resistance to reverse engineering — describes a cryptographic design that Microsoft characterized as sound with no practical recovery path.
DeadLock uses a three-layer hybrid scheme. For each target file, the malware generates a fresh 32-byte random key and a 24-byte nonce to encrypt the file contents using XChaCha20, a high-speed stream cipher designed by cryptographer Daniel J. Bernstein. It then generates a per-file ephemeral Curve25519 keypair and performs an elliptic-curve Diffie-Hellman exchange against the operator’s embedded public key, producing a unique shared secret for that file. That shared secret is used with the NaCl crypto_box construction — combining XSalsa20 and Poly1305 for authenticated encryption — to wrap the XChaCha20 key and nonce before appending them to the end of the encrypted file.
The critical detail is the “per-file ephemeral” design. Every file gets its own freshly generated keypair and its own unique shared secret. This eliminates key reuse across files — a property that has allowed researchers to recover data from cryptographically weaker ransomware families in the past. Microsoft was explicit: there is no mathematical shortcut to decryption without the attacker’s private key.
The encryptor also applies a tiered strategy based on file size. Files smaller than roughly 50 MB receive full encryption. Larger files are encrypted in intermittent 512-byte chunks distributed across the file — 50% for files around 50 MB, dropping to 25% at around 118 MB, 10% at roughly 500 MB, and a special chunked-full mode for files above about 1 GB. A database or a virtual machine image rendered unusable by encrypting one-tenth of its content in scattered blocks is as operationally unusable as one fully encrypted — but takes a fraction of the time, which matters for evading behavioral detection.
A resource-aware throttling mechanism makes detection harder still. A monitoring thread polls system memory and CPU utilization before dispatching each new file to an encryption worker. If memory use exceeds 29% or CPU load exceeds 70% (meaning idle time falls below 30%), dispatching pauses until resources return below those thresholds. The result is a machine that continues functioning visibly normally — suppressing the sudden performance spike that might alert a user or trigger a behavioral detection rule — while encryption proceeds in the background.
EDR Goes Dark Before Encryption Starts
Before touching a single file, DeadLock systematically removes the defenses that would detect it.
The pre-encryption routine begins with a language-based exit check: if the infected machine’s system language matches an embedded exclude list — covering Russian, Ukrainian, Belarusian, Kazakh, Georgian, Armenian, Persian, and several other languages associated with former Soviet and Commonwealth of Independent States (CIS) regions, plus Oman and Yemen — the malware self-deletes without encrypting anything. Security researchers widely associate this pattern with ransomware operators who either operate from those regions or wish to avoid legal exposure there.
DeadLock then enumerates every running Windows service and terminates those matching its embedded stop list, including windefend (Windows Defender), Volume Shadow Copy and Backup services, Hyper-V services, and Active Directory services. A parallel process kill list targets security tools including Microsoft’s SmartScreen and MsMpEng processes, cloud sync clients including OneDrive, Dropbox, and Google Drive (removing cloud-based recovery options), remote access utilities, and even Windows Explorer and PowerShell.
The Bring Your Own Vulnerable Driver (BYOVD) technique goes further than software-level termination. Earlier DeadLock campaigns documented by Cisco Talos in December 2025 used a loader that exploited CVE-2024-51324, a flaw in a legitimate Baidu Antivirus driver (BdApiUtil.sys), to reach Ring 0 — the kernel’s most privileged execution layer — and terminate EDR processes from a level where even the protected security software cannot resist. Because the driver carries a valid Microsoft signature and operates at kernel level, it can shut down security tools that would otherwise block the attack. ReliaQuest’s Q2 2026 report noted that BYOVD “breaks the two controls most organizations lean on: network blocking loses value when C2 rotates on demand, and mature EDR loses telemetry when it’s killed at the kernel.”
Event log destruction is equally thorough. DeadLock clears standard Windows channels including Application, Security, System, and PowerShell logs via the classic Event Log API. It then enumerates every registered event log channel in the WINEVT registry tree, disables future logging by setting each channel’s Enabled value to zero, and overwrites the channel access permissions with a restrictive SDDL descriptor. Finally, it uses wevtapi.dll to enumerate and clear every additional registered channel, including third-party application logs and custom diagnostic channels. An incident responder arriving at an infected host will find very little forensic evidence.
What the Victim Finds: An Interactive Extortion Application
After encryption completes, DeadLock drops two ransom artifacts. The text note (HOW_RECOVER.
Opening it in any browser launches a full interactive web application — no server required — containing three functional components. The Chat tab derives the victim’s Session identity deterministically from credentials they enter, creating an Ed25519 keypair that is then converted to Curve25519 format to form a Session network address. This means no account registration is required, the identity exists only when the victim enters the correct credentials, and if those credentials are lost, the communication channel is permanently gone. Messages travel onion-routed through Session’s swarm of service nodes, giving operators effective anonymity.
The Blog tab fetches content directly from the Polygon smart contract, displaying the group’s data leak posts — including stolen files the victim can browse through an embedded AWS S3-compatible file browser that generates pre-signed Wasabi download URLs on demand. The stolen data lives in Wasabi cloud storage; the directory listing lives on the blockchain. No web server the operators need to maintain or defend.
Session is a decentralized, open-source messaging protocol that uses three-hop onion routing through community-operated service nodes, with no phone number or email address required for account creation and no central server for authorities to serve legal demands on. That makes it an adversary-friendly platform regardless of its original intent — and DeadLock has made it the core of victim-operator negotiation.
Who Is Being Hit
Microsoft identified DeadLock ransomware impacting organizations across information technology, mining, transportation and logistics, manufacturing, hospitality, consumer goods, and other sectors. As of July 2026, more than half of the 80-plus claimed victims on the DeadLock blog are based in Europe, with the rest spread across Asia, the Americas, and Africa.
The group first appeared in July 2025 and operated quietly for nearly 11 months, working through private extortion via Session rather than maintaining a public leak site — a choice that kept it off most threat-intelligence feeds keyed to data-leak site monitoring. ReliaQuest noted that the group posted 75 new victims in June 2026 alone, a pace that rivals established ransomware-as-a-service programs, and characterized its prior low profile as a deliberate operational posture rather than low capability.
Microsoft has observed DeadLock being deployed by multiple groups, including an affiliate of the Lynx and INC ransomware ecosystems, suggesting at least a partial ransomware-as-a-service model.
Is Blockchain C2 About to Go Mainstream?
ReliaQuest’s July 2026 quarterly report assessed with moderate confidence that blockchain-based command-and-control will spread beyond DeadLock before year’s end, noting that Cry0 ransomware had already begun using the Internet Computer Protocol (ICP) blockchain for extortion negotiations — a narrower use than DeadLock’s full proxy rotation inside a Polygon smart contract, but pointing in the same direction.
The barrier to adoption is low. DeadLock’s approach uses public blockchain primitives and straightforward proxy rotation. Any group capable of deploying a smart contract — a task requiring minimal technical knowledge and approximately one dollar in cryptocurrency — can replicate the core infrastructure rotation architecture without custom tools.
For defenders, ReliaQuest recommended monitoring outbound traffic from servers or non-developer endpoints to Polygon RPC providers — including public mirrors such as polygon-rpc.com, polygon.drpc.org, and polygon-bor-rpc.publicnode.com — and treating Session messenger activity from enterprise endpoints as anomalous. These behavioral signals would catch the DeadLock infrastructure pattern regardless of which specific group is using it.
What Defenders Should Do Right Now
Microsoft’s report includes specific, actionable mitigations built around Microsoft Defender for Endpoint.
Enable tamper protection in Microsoft Defender Antivirus. DeadLock’s pre-encryption routine directly targets the windefend service; tamper protection prevents the kind of service-killing the group relies on. Run EDR in block mode so that Microsoft Defender for Endpoint can block malicious artifacts even when a third-party antivirus is the primary solution — and even after EDR telemetry may have been partially degraded. Configure Controlled Folder Access to restrict unauthorized write access to sensitive directories. Enable attack surface reduction rules, particularly those blocking executables that do not meet prevalence or age criteria, blocking PsExec- and WMI-originated process creations, and enabling advanced ransomware protection.
Offline, immutable backups are the most important single control. DeadLock specifically targets Volume Shadow Copies, Windows Backup Engine services, and cloud sync clients including OneDrive, Dropbox, and Google Drive. Any backup that is reachable from an infected machine can be deleted. Backups that are physically or logically isolated from the production environment cannot be.
To counter BYOVD at the kernel level, ReliaQuest recommended enforcing Microsoft’s vulnerable-driver block list via Windows Defender Application Control (WDAC) with Hypervisor-Protected Code Integrity (HVCI). Standard antivirus does not catch the BYOVD chain exploiting CVE-2024-51324, but HVCI will.
Microsoft Defender detects DeadLock components under the signature family Ransom:Win32/Deadlock.*. In block mode, Defender for Endpoint will alert as 'DeadLock' ransomware was detected or 'DeadLock' ransomware was prevented.
Indicators of Compromise
Network defenders can watch for the following indicators identified by Microsoft:
| Indicator | Type |
|---|---|
| SHA-256 hash (encryptor binary) |
| Domain (leak site) |
| Domain (leak site) |
| Domain (leak site) |
| Domain (leak site) |
| Onion URL (leak site, Tor) |
Encrypted files are renamed with the extension .dlock. Victims will find ransom notes named HOW_RECOVER. and the HTML recovery application as RECOVERY_CHAT..
Frequently Asked Questions
What is DeadLock ransomware, and why is it different from other ransomware?
DeadLock is a double-extortion ransomware group that first appeared in July 2025. What distinguishes it from most peers is its recovery infrastructure: instead of relying on dark-web sites or conventional command-and-control servers that law enforcement can seize or disrupt, it stores its proxy server address and data leak content inside Polygon blockchain smart contracts. Because blockchain data is decentralized and persistent, there is no central host to take offline. Microsoft’s analysis of the encryptor itself found the cryptographic design — combining Curve25519 elliptic-curve key exchange with XChaCha20 encryption and per-file ephemeral keypairs — to be sound, meaning there is no practical path to decryption without the attacker’s private key.
Can DeadLock ransomware be decrypted without paying?
Based on Microsoft’s technical analysis, no. DeadLock uses per-file ephemeral Curve25519 keypairs, meaning every encrypted file has its own unique key derived from a unique key exchange. There is no shared key across files, no reused nonce, and no implementation flaw that cryptographic researchers have identified as exploitable for recovery. Victims who do not have intact offline backups are left with the choice between paying or losing their data.
Will other ransomware groups copy DeadLock’s blockchain command-and-control approach?
Analysts at ReliaQuest assessed in their Q2 2026 ransomware report that blockchain-based command-and-control will likely spread beyond DeadLock before year-end 2026, citing moderate confidence. Cry0 ransomware has already adopted a similar approach using the Internet Computer Protocol blockchain for extortion negotiations. The technique requires minimal technical expertise and roughly one dollar in cryptocurrency to implement — meaning the adoption barrier is low enough for any moderately capable group. The implication for defenders: behaviors that detect blockchain-based command-and-control (outbound Polygon RPC traffic from non-developer enterprise endpoints, Session messenger activity) need to become standard detection targets regardless of which specific ransomware family is running.
What is BYOVD, and why does it matter for stopping ransomware?
Bring Your Own Vulnerable Driver (BYOVD) is a technique where attackers load a legitimate but flawed signed Windows kernel driver to gain Ring 0 access — the most privileged layer of the operating system — and use it to terminate endpoint detection and response (EDR) processes before encryption begins. Because the driver is legitimately signed and operates at the same privilege level as the EDR software itself, even fully protected security processes can be killed. DeadLock has used this technique with CVE-2024-51324, a flaw in a Baidu Antivirus driver, and ReliaQuest estimated that roughly 25% of ransomware attacks in 2024 incorporated some form of BYOVD. The standard mitigation is enforcing Microsoft’s vulnerable-driver block list via Windows Defender Application Control with Hypervisor-Protected Code Integrity — standard antivirus does not block the BYOVD chain.
Click Here For The Original Source.
