DeadLock - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/actors/deadlock/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 11 Aug 2026 18:45:27 +0000DeadLock Ransomware Leverages Polygon Smart Contracts for Resilient C2https://feed.craftedsignal.io/briefs/2026-08-deadlock-ransomware/Tue, 11 Aug 2026 18:45:27 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-deadlock-ransomware/The DeadLock ransomware group employs decentralized infrastructure, including Polygon smart contracts, to rotate proxy servers and host data leak blogs, complicating traditional takedown efforts.DeadLock ransomware, active since July 2025, has evolved its operational infrastructure to utilize decentralized technologies. The group uses a custom recovery ecosystem that integrates the Session messaging network with blockchain-backed services to manage communications and data exfiltration. By leveraging Polygon smart contracts, DeadLock operators can dynamically update proxy server addresses for their interactive HTML-based recovery chat and maintain a decentralized data leak blog via the Wasabi protocol. This architecture eliminates reliance on traditional, disruptible web infrastructure. The ransomware uses a hybrid cryptographic design (Curve25519 and XChaCha20) and features geofencing, resource-aware throttling (capping CPU/memory usage), and extensive defense evasion techniques. With 96 victims identified primarily in Italy, Spain, Poland, Türkiye, and the U.S., the group continues to expand its reach by partnering with affiliates of other ransomware operations like Lynx and INC.

Attack Chain

  1. Initial access is established, often involving the use of AnyDesk for remote control of compromised hosts.
  2. The ransomware payload is deployed, which performs environment reconnaissance and applies geofencing to avoid specific CIS and Middle Eastern regions.
  3. A PowerShell script is executed to identify and stop non-allowlisted services and prevent their automatic restart.
  4. The malware clears event logs and modifies the Registry to disable further logging, effectively minimizing forensic footprint.
  5. Volume Shadow Copies are deleted to prevent easy file recovery, followed by the encryption of files using the .dlock extension.
  6. The ransomware performs resource-aware throttling to maintain system responsiveness, pausing encryption if CPU load exceeds 70% or memory exceeds 29%.
  7. A custom ".ico" file is written to disk to modify file icons, and the desktop wallpaper is updated with a ransom notification.
  8. The malware drops a self-contained HTML file (RECOVERY_CHAT.<UID>.html) to drive roots and Desktop folders, which facilitates communication and data leak access via Polygon-hosted proxy addresses.

Impact

DeadLock ransomware has successfully targeted 96 organizations as of August 2026. Victims suffer from double extortion, where sensitive data is exfiltrated and threatened for release on a decentralized blog. The use of blockchain-based infrastructure increases the persistence of the threat actor's communications, making it significantly harder for law enforcement and security teams to disrupt the negotiation and extortion phases.

Recommendation

  • Deploy the Sigma rules provided in this brief to detect the drop and execution of the ransom recovery HTML files.
  • Implement monitoring for PowerShell scripts that interact with shadow copy deletion commands, such as 'vssadmin delete shadows'.
  • Monitor for unauthorized use of remote access tools like AnyDesk within the environment.
  • Configure SIEM rules to alert on abnormal Registry modifications intended to disable Windows Event Logging.
  • Block egress traffic to the identified proxy server IP (138.226.236.51) at the firewall or DNS resolver level.
]]>highthreatransomwareblockchainextortiondata-exfiltration