A ransomware group called DeadLock has taken an unusual approach to staying online: instead of relying on Tor hidden services or conventional domains that law enforcement can seize, it stores its key infrastructure addresses on the Polygon blockchain. Researchers at Microsoft identified the technique while analyzing a series of attacks that have hit roughly 80 organizations — mostly in Europe — since the group emerged in mid-2025. Victims span IT, manufacturing, transportation, mining, hospitality, and consumer goods.
The mechanics are straightforward in concept but novel for ransomware. DeadLock’s victim-facing chat interface retrieves the current address of the chat proxy by querying a smart contract on Polygon using a standard eth_call — a read-only blockchain lookup. Because the Polygon ledger is public and permissionless, neither law enforcement nor any platform can remove that pointer. The operators can swap the underlying chat proxy whenever they need to without touching the victim-facing application. Communication between victims and the operators is further layered through the decentralized Session network, and stolen files are hosted on the Wasabi cloud storage service. The combination means there is no single server to seize, no domain to sinkhole, and no hosting company to compel.
That said, Microsoft notes the resilience is not absolute: communications still route through a custom proxy that could be blocked, Polygon’s public RPC endpoints must remain reachable, and Wasabi can remove specific stored data. DeadLock also follows a standard double-extortion playbook — encrypting files with per-file XChaCha20 keys protected by Curve25519, then threatening to publish the stolen data if the ransom is not paid. The locker avoids systems in former Soviet Union countries, Iran, Syria, Oman, and Yemen — a geographic exclusion common among groups believed to operate from within those regions. Microsoft observed the malware being deployed by multiple affiliates, including at least one previously linked to the Lynx and INC ransomware families.