The **DeadLock** ransomware group has been observed employing decentralized infrastructure to facilitate victim communications and data leak operations. This strategic shift aims to improve the group's operational resilience against law enforcement and cybersecurity interventions. ### A New Era of Ransomware Resilience **Microsoft Threat Intelligence** highlighted **DeadLock**'s recovery ecosystem, which combines the **Session** messaging network with blockchain-backed services. These services are crucial for storing and delivering resources used throughout the extortion process, as detailed in a **Microsoft** analysis. First detected in July 2025, **DeadLock** utilizes double extortion tactics, encrypting victim environments and threatening to publicly release exfiltrated data. As of this month, the group has claimed 96 victims, predominantly in Italy, Spain, Poland, Türkiye, and the U.S. ### Under the Radar Operations Singapore-headquartered **Group-IB** noted in an earlier January analysis that **DeadLock** has maintained a lower profile compared to its peers. This is attributed to its lack of association with known affiliate programs and the absence of a traditional data leak site (DLS). According to **Ransomware.Live**, the first set of victims was not publicly discovered until late May 2026. Attacks by **DeadLock** encrypt files with the ".dlock" extension, modify file icons, and change the victim's wallpaper to display a ransom message, instructing them to open the ransom note. ### Technical Sophistication and Evasion Tactics The ransomware employs a selective encryption model, excluding specific directories, file extensions, and file names. It uses a hybrid cryptographic design, combining **Curve25519** elliptic-curve cryptography with the **XChaCha20** stream cipher for file encryption. The ransom note directs victims to download **Session**, a decentralized, end-to-end encrypted messaging application, to initiate contact and make payments in **Bitcoin** or **Monero**. The group offers to provide a decrypted file as proof and, in some versions of the note, claims to offer a "security report" detailing their breach methods and future security recommendations. **DeadLock** also implements language- or country-based geofencing, avoiding execution in environments associated with former Soviet and Commonwealth of Independent States (CIS)-linked countries, as well as select Middle Eastern countries.  ### Advanced Evasion and Communication Channels The ransomware includes a "resource-aware throttling mechanism" to maintain system responsiveness during encryption, pausing operations when memory or CPU usage exceeds predefined thresholds. It also leverages **AnyDesk** for remote control of compromised hosts and systematically erases logs and disables logging via Registry manipulation to minimize forensic evidence. For Windows systems, a **PowerShell** script stops non-allowlisted services, prevents their automatic execution after reboot, deletes **Volume Shadow Copies**, and self-erases to cover tracks. Post-encryption, a batch script deletes the malware's binary. ### Blockchain-Powered Communication and Data Leaks Perhaps the most unusual aspect is the use of an HTML note ("RECOVERY_CHAT.<UID>.html") dropped in all drive root directories and Desktop folders. This HTML file functions as a full interactive web application, providing an end-to-end encrypted chat, a paginated data leak blog, and a file browser, all without requiring a traditional backend server. This HTML file facilitates direct communication between **DeadLock** operators and victims, serving as an alternative to downloading the **Session** app. It sends and receives messages from a proxy server, with details managed via a blockchain-based approach. Specifically, JavaScript code within the HTML file interacts with **Polygon** smart contracts for decentralized proxy server address rotation. This innovative method creates a censorship- and takedown-resistant infrastructure, allowing operators to update proxy URLs without touching victim-facing domains or registration. **Group-IB** commented that "This exploit of smart contracts to deliver proxy addresses is an interesting method where attackers can literally apply infinite variants of this technique." The recovery chat page also offers access to a data leak blog, with content hosted on the **Polygon** blockchain, providing browsable access to leaked files via the **Wasabi** protocol without needing a web server. The two wallet addresses used by the threat actor are: * **0x8EF7c3e531d871D3B9D559722DE77EB1dEc19dAe**, which stores the proxy server URL ("138.226.236[.]51/prrq.php") * **0x757984507c82c8dA1d3969c535dB5706eEE6426C**, which stores the blog posts **Microsoft** concludes that "This infrastructure model represents a meaningful evolution from traditional ransomware communication channels and poses new challenges for takedown efforts." This architecture significantly enhances the resilience of **DeadLock**'s communication, leak-hosting, and negotiation infrastructure, allowing operators to recover from disruptions and maintain continuity for victims.