DeadLock Ransomware Moves Its Extortion Kit onto the Blockchain

Key points

• DeadLock, a ransomware crew active since 2024, has rebuilt its extortion setup on decentralised tools that are harder for police to take offline, according to Microsoft Threat Intelligence.
• The group uses Session, an encrypted messaging app that doesn't require a phone number, to talk to victims instead of a normal website.
• Files that keep the extortion running are stored using smart contracts on Polygon, a public blockchain, so there is no single server to seize.
• Victims are still companies, and the pressure tactic is the same: pay up, or your stolen files get published.
• Microsoft says the design is about "operational resilience," a polite way of saying the crooks got tired of losing their leak sites.

Ransomware, which is malicious software that locks a company's files and demands a payment to unlock them, has a boring weak spot: the crooks need somewhere to host their threats and negotiate with victims. Police keep seizing those places. So the gang behind DeadLock has started borrowing tricks from the cryptocurrency world to make its setup harder to knock down.

Microsoft Threat Intelligence flagged the shift this week, and it was picked up by The Hacker News. The short version: DeadLock has moved the plumbing of its extortion operation onto tools that don't have a central owner.

What is DeadLock actually doing differently?

Instead of running a normal dark-web leak site and a normal chat portal, DeadLock is using two decentralised pieces. One is Session, a messaging app that works without a phone number or email and routes messages through a scattered network of relays. The other is Polygon, a public blockchain often used for cheap crypto transactions.

The gang is storing files that its ransomware needs, things like configuration data and links to stolen material, inside smart contracts on Polygon. A smart contract is just a small program that lives on the blockchain and does what it was written to do whenever someone pokes it. Anyone in the world can read it. Nobody can quietly delete it.

That matters because the usual way to disrupt a ransomware crew is to seize its servers or shut down its Tor hidden service. You cannot seize a smart contract. You would have to shut down the entire Polygon network, which is not going to happen.

Is this really a new attack, or a new hiding place?

Honestly, it is a new hiding place. The ransomware itself still has to break into a company, steal files, and encrypt machines the old-fashioned way, usually through stolen passwords, phishing emails, or unpatched software. The blockchain part only kicks in once the victim is already in trouble.

Compare it to a classic web pattern: it is closer to attackers hosting malware on a service like GitHub or Amazon S3 to dodge takedowns. Same idea, tougher venue. What's genuinely new is that ransomware crews are now willing to pay small Polygon transaction fees for every update to their extortion infrastructure, because the resilience is worth it to them.

Should ordinary people be worried?

Not directly. DeadLock targets organisations, not personal laptops. But if a company you deal with, your dentist, your local council, your insurer, gets hit, your data could end up on a leak channel that police cannot easily take down. That means once information is out, it stays out for longer.

If you get a notice from a company saying it has been hit by ransomware, treat it seriously. Change any password you used there. Watch for phishing emails that quote real details from your account, because criminals often mine leaked data for convincing lures.

What defenders should take from this

For security teams, the takeaway is simple and slightly annoying. Waiting for law enforcement to disrupt a gang's back end is a worse bet than it used to be. Prevention, catching the intrusion before encryption, is where the winnable fight is. The blockchain flourish is downstream of a stolen password or an unpatched box.