DeadLock Ransomware: New Strain Hides C2 in Polygon Smart Contracts

A new ransomware family, DeadLock, was discovered in July 2025 and is notable not for volume but for its innovative use of Polygon smart contracts to manage its command-and-control infrastructure. According to Group-IB specialists, the malware stores and rotates the addresses of its proxy servers by embedding the proxy URL directly into the blockchain via a setProxy function, creating an immutable, resilient communication channel that is difficult for law enforcement to takedown.

Early ransom notes, observed in June 2025, focused on encryption, but by August, the notes evolved to threaten data theft and exposure, including an incident report as part of the extortion. Victims are directed to negotiate via Session, a decentralised messenger, with DeadLock dropping a custom HTML wrapper to facilitate encrypted communication between victim and extortionist.

The report notes that DeadLock relies on a mix of custom malware and legitimate tools, including a PowerShell script designed to stop non-whitelisted services, with AnyDesk appearing to be the group’s main remote monitoring and management tool.