Deadlock Ransomware Uses Blockchain for C2 Resilience

2026-08-12 01:06 UTC 3 min read Runtime Rebel Intel

This article was written by a language model from the source above and was not reviewed by a human before publication. Verify anything operational against the original. Editorial policy

Key points

Organizations across IT, mining, transportation, and manufacturing sectors face double-extortion attacks by Deadlock ransomware operators.
The malware targets Windows hosts, utilizing XChaCha20 and Curve25519 encryption while avoiding specific geopolitical regions.
Defenders must deploy EDR in block mode, enable tamper protection, and restrict unauthorized file changes.

Overview of Deadlock Ransomware

Emerging in mid-2025, the Deadlock ransomware operation employs double-extortion tactics, combining file encryption with data theft and leak activities to pressure victims into paying a ransom. According to BleepingComputer, researchers observed multiple groups deploying the payload, including affiliates previously associated with the Lynx and INC ecosystems. By July of last year, the threat actor’s data leak site had listed 80 organizations, predominantly located in Europe across sectors such as IT, mining, transportation, manufacturing, hospitality, and consumer goods.

Technical Details and Blockchain Integration

Unlike traditional ransomware strains that rely heavily on Tor hidden services for command-and-control (C2) and communication, Deadlock adopts a decentralized infrastructure. The operators utilize the Polygon blockchain to store configuration data and leak site posts.

Victim-facing HTML pages retrieve current chat-proxy addresses by querying a smart contract on the Polygon blockchain via read-only eth_call functions. Additionally, the operation leverages the decentralized Session network for encrypted communications with victims and the Wasabi cloud service for hosting stolen data. This architecture allows operators to replace chat proxies dynamically without altering the client-facing application, reducing reliance on conventional web servers vulnerable to law enforcement seizures.

Encryption Mechanics and Host Preparation

Before executing file encryption, the ransomware prepares the Windows host by:

Deleting system backups and emptying the Recycle Bin.
Stopping virtualization services.
Validating that the target system is not located in excluded regions, such as countries in the former Soviet Union, the Commonwealth of Independent States (CIS), Iran, Syria, Oman, and Yemen.

The locker uses up to 29% of available system memory and 70% of CPU resources to ensure victims can continue operating the machine during encryption without noticeable performance degradation. Non-system directories are encrypted using unique per-file XChaCha20 keys protected by the Curve25519 elliptic curve. Large files undergo intermittent encryption using 512-byte blocks to accelerate the process while rendering data unrecoverable. Encrypted files are appended with the .dlock extension, and ransom notes demand payment in Bitcoin or Monero.

Mitigation and Defense Strategies

While blockchain-backed infrastructure enhances operational resilience, Microsoft noted that dependencies remain, such as the requirement for public Polygon RPC endpoints and custom proxies. Organizations should prioritize the following defensive measures:

Strengthen endpoint defenses with cloud-delivered antivirus protection and Endpoint Detection and Response (EDR) configured in block mode.
Enforce tamper protection and automated investigation and remediation capabilities.
Restrict unauthorized file changes using Controlled Folder Access.
Implement attack-surface reduction rules to block untrusted executables and mitigate lateral movement vectors like PsExec and WMI.

#Ransomware #Malware

X/Twitter LinkedIn Reddit HN

← Back to Articles