DeadLock Ransomware Moves Its Extortion Kit onto the Blockchain

Key points

• DeadLock, a ransomware crew active since 2024, has rebuilt its extortion setup on decentralised tools that are harder for police to take offline, according to Microsoft Threat Intelligence.
• The group uses Session, an encrypted messaging app that requires no phone number, to communicate with victims instead of a conventional website.
• Files that keep the extortion running are stored using smart contracts on Polygon, a public blockchain, so there is no single server to seize.
• Victims are still organisations, and the pressure tactic is unchanged: pay up, or your stolen files get published.
• Microsoft says the design is about "operational resilience," a polite way of saying the crooks got tired of losing their leak sites.

Ransomware, malicious software that locks a company's files and demands payment to restore access, has one consistent weak spot: the crooks need somewhere to host their threats and negotiate with victims. Police keep seizing those places. So the gang behind DeadLock has started borrowing tricks from the cryptocurrency world to make its setup harder to knock down.

Microsoft Threat Intelligence flagged the shift, picked up by The Hacker News. The short version: DeadLock has moved the plumbing of its extortion operation onto tools without a central owner. We first covered DeadLock on 11 August 2026; this development is a meaningful escalation of what was already a deliberately evasive operation.

What is DeadLock actually doing differently?

Instead of running a dark-web leak site and a chat portal, DeadLock now relies on two decentralised pieces. One is Session, a messaging app that works without a phone number or email and routes messages through a scattered network of relays. The other is Polygon, a public blockchain commonly used for low-cost crypto transactions.

The gang stores files its ransomware needs, configuration data and links to stolen material, inside smart contracts on Polygon. A smart contract is a small program that lives on the blockchain and executes automatically when triggered. Anyone can read it. Nobody can quietly delete it.

That matters because the standard way to disrupt a ransomware crew is to seize its servers or shut down its Tor hidden service. A smart contract cannot be seized without taking down the entire Polygon network, which is not going to happen.

Is this really a new attack, or a new hiding place?

Honestly, a new hiding place. The ransomware itself still has to break into a target through stolen credentials, phishing emails, or unpatched software, then steal data and encrypt machines the old-fashioned way. The blockchain part only activates once the victim is already in trouble.

The closest analogy is attackers hosting malware on GitHub or Amazon S3 to dodge takedowns: same logic, tougher venue. What's genuinely new is that ransomware crews are now willing to pay small Polygon transaction fees on every infrastructure update, because the resilience is worth it to them.

Should ordinary people be worried?

Not directly. DeadLock targets organisations, not personal laptops. But if a company you deal with gets hit, your data could end up on a leak channel that police cannot easily remove. Once information is out, it stays out longer.

If you receive a breach notice from a company, change any password you used there and watch for phishing emails that quote real details from your account. Criminals routinely mine leaked data for convincing lures.

What defenders should take from this

For security teams, the conclusion is simple and slightly annoying. Waiting for law enforcement to disrupt a gang's backend is a worse bet than it used to be. Catching the intrusion before encryption begins is where the winnable fight is. The blockchain infrastructure is downstream of a stolen password or an unpatched box, and that hasn't changed at all.