The **DeadLock** ransomware operation, which first emerged in mid-2025, employs double-extortion tactics, combining data theft and file encryption to pressure victims into paying ransoms. By July of this year, **DeadLock**'s data leak site reportedly listed 80 organizations, predominantly from Europe, spanning sectors such as IT, mining, transportation, manufacturing, hospitality, and consumer goods. Researchers at **Microsoft** have observed the malware being deployed by multiple groups, including an affiliate previously linked to the **Lynx** and **INC** ransomware ecosystems. ## Blockchain-Backed Infrastructure **DeadLock** operators have adopted a novel strategy that leverages the **Polygon** blockchain to store configuration data and manage posts on their leak site. Instead of relying on traditional **Tor** URLs, the HTML-based chat application retrieves the current chat-proxy address by querying a smart contract on the **Polygon** blockchain via a read-only `eth_call`.  *Source: Microsoft* While retrieving command-and-control (C2) addresses from the blockchain is becoming a more common tactic for cybercriminals, its application within the ransomware space remains relatively rare. Furthermore, **DeadLock** utilizes the decentralized **Session** network for encrypting victim communications and provides access to stolen files hosted on the **Wasabi** cloud service. This multi-pronged decentralized approach allows operators to replace chat proxies without altering the victim-facing application, significantly reducing their dependency on conventional domains and web servers that are vulnerable to law enforcement intervention. However, **Microsoft** notes that this resilience is not absolute. Communications still necessitate a custom proxy, public **Polygon** RPC endpoints must remain accessible, and files hosted on **Wasabi** can still be removed, indicating potential avenues for disruption.  *Source: Microsoft* ## DeadLock's Encryption Scheme **Microsoft**'s report also details **DeadLock**'s sophisticated encryption system. The ransomware is configured to avoid targeting countries in the former Soviet Union and the Commonwealth of Independent States (**CIS**) region, as well as Iran, Syria, Oman, and Yemen. Upon infecting a **Windows** host, the locker prepares the system by deleting backups, stopping virtualization services, and emptying the Recycle Bin. It then encrypts select non-system directories using unique per-file **XChaCha20** keys, protected with the **Curve25519** elliptic curve. The ransomware is designed to consume up to 29% of available system memory and 70% of CPU resources, aiming to allow the victim to continue using the machine during the encryption process without immediate, noticeable performance degradation. Larger files are intermittently encrypted using 512-byte blocks to expedite the process while ensuring they are mostly irrecoverable. Encrypted data is renamed with a victim-specific identifier and the '.dlock' extension, icons are altered, TXT ransom notes are dropped, and the desktop wallpaper is changed to visually indicate system compromise.  *Source: Microsoft* Attackers demand ransom payments in **Bitcoin** or **Monero** in exchange for a decryptor, a promise to delete stolen data, details about the initial access vector, and a set of security recommendations. ## Defense Recommendations To defend against **DeadLock** ransomware attacks, **Microsoft** advises organizations to strengthen endpoint defenses through cloud-delivered antivirus protection, **EDR** in block mode, tamper protection, automated investigation and remediation, and automatic attack disruption. Organizations should also restrict unauthorized file changes using Controlled Folder Access and enable attack-surface reduction rules to block untrusted executables and lateral movement via **PsExec** and **WMI**.