GoKawiilThe DeadLock ransomware operation is using a decentralized infrastructure that relies on blockchain-backed services to protect its communication with victims and data-leak activity.
The threat actor emerged in mid-2025 and uses double-extortion tactics (data theft/leak and file encryption) to pressure victims into paying a ransom.
By July this year, DeadLock's data leak site listed 80 organizations, mostly from Europe. Victims include companies in the IT, mining, transportation, manufacturing, hospitality, and consumer goods sectors.
Microsoft researchers observed the malware being deployed by multiple groups, including an affiliate previously linked to the Lynx and INC ransomware ecosystems.
The DeadLock ransomware operators adopted a new approach that uses the Polygon blockchain to store configuration data and the posts on the leak site.
Instead of using a traditional Tor URL, the HTML page retrieves the current chat-proxy address by querying a smart contract on the Polygon blockchain through a read-only eth_call .
DeadLock's HTML chat app
Source: Microsoft
Retrieving command-and-control (C2) addresses stored on the blockchain is now a common tactic for cybercriminals, but it is a rare occurrence in the ransomware space.
Additionally, DeadLock uses the decentralized Session network to encrypt victim communications and provides access to stolen files hosted on the Wasabi cloud service.
... continue reading