--- title: DeadLock ransomware uses blockchain to resist... description: The DeadLock ransomware group, active since mid-2025, has adopted a novel decentralized infrastructure using the Polygon blockchain to store C2 configuration... canonical: https://daily.dev/posts/deadlock-ransomware-uses-blockchain-to-resist-infrastructure-takedown-ay3u9m6e9 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: DeadLock ransomware uses blockchain to resist infrastructure takedown | daily.dev og:description: The DeadLock ransomware group, active since mid-2025, has adopted a novel decentralized infrastructure using the Polygon blockchain to store C2 configuration... og:url: https://daily.dev/posts/deadlock-ransomware-uses-blockchain-to-resist-infrastructure-takedown-ay3u9m6e9 og:image: https://api.daily.dev/og/posts/ay3u9M6e9.png og:image:alt: DeadLock ransomware uses blockchain to resist infrastructure takedown og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # DeadLock ransomware uses blockchain to resist infrastructure takedown **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 3 min read · 0 upvotes · 0 comments ## Summary The DeadLock ransomware group, active since mid-2025, has adopted a novel decentralized infrastructure using the Polygon blockchain to store C2 configuration data and leak site posts, making law enforcement takedowns significantly harder. Victims communicate via the Session encrypted messaging network, and stolen files are hosted on Wasabi cloud storage. By querying a Polygon smart contract via eth_call, the operators can rotate chat proxies without touching victim-facing code. The malware, written in Rust, uses XChaCha20 per-file encryption with Curve25519 key protection, limits itself to 29% RAM and 70% CPU to avoid detection, and targets non-CIS/non-Middle-Eastern organizations. By July, 80 organizations—mostly European—had appeared on its leak site. Microsoft recommends EDR in block mode, Controlled Folder Access, and attack-surface reduction rules as defenses. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How does DeadLock ransomware use the Polygon blockchain to avoid takedowns? DeadLock stores its C2 chat-proxy address in a Polygon smart contract, retrieved via a read-only eth_call. This lets operators rotate the proxy without modifying the victim-facing HTML page, eliminating dependence on conventional domains that law enforcement can seize. Victim communications are encrypted via the Session network, and stolen data is hosted on Wasabi cloud storage, further distributing the infrastructure. _Security teams tracking ransomware infrastructure evasion techniques find the latest threat intelligence on daily.dev._ ### What encryption algorithm does DeadLock ransomware use to encrypt files? DeadLock encrypts files using unique per-file XChaCha20 keys, each protected with Curve25519 elliptic-curve cryptography. Larger files are intermittently encrypted in 512-byte blocks to speed up the process while still rendering them largely irrecoverable. The ransomware caps itself at 29% of system memory and 70% of CPU to avoid triggering performance alerts during encryption. _Defenders responding to ransomware incidents stay current on encryptor internals through daily.dev._ ### Which countries does DeadLock ransomware avoid targeting? DeadLock is configured to skip systems in former Soviet Union and Commonwealth of Independent States (CIS) countries, as well as Iran, Syria, Oman, and Yemen. Its known victims are predominantly European organizations across IT, mining, transportation, manufacturing, hospitality, and consumer goods sectors, with 80 organizations listed on its leak site by July. _Threat intelligence on ransomware targeting patterns like these surfaces regularly for security teams on daily.dev._ ## Similar posts on daily.dev - [DeadLock ransomware uses smart contracts to evade defenders](https://daily.dev/posts/deadlock-ransomware-uses-smart-contracts-to-evade-defenders-w3wsargib) · The Register · 1 upvotes · 0 comments - [Ransomware groups switch to stealthy attacks and long-term access](https://daily.dev/posts/ransomware-groups-switch-to-stealthy-attacks-and-long-term-access-odq0idhho) · CSO Online · 0 upvotes · 0 comments - [Reviewing the trends in ransomware attacks in 2026](https://daily.dev/posts/reviewing-the-trends-in-ransomware-attacks-in-2026-zduvsdh2i) · Securelist · 0 upvotes · 0 comments - [Flash Alert: EtherRat and TukTuk C2 End in The Gentleman Ransomware](https://daily.dev/posts/flash-alert-etherrat-and-tuktuk-c2-end-in-the-gentleman-ransomware-93fmx6xzg) · The DFIR Report · 0 upvotes · 0 comments - [How Ransomware Works: Encryption Is the Least of Your Problems](https://daily.dev/posts/how-ransomware-works-encryption-is-the-least-of-your-problems-1qcqveeyz) · Latest Hacking News · 1 upvotes · 0 comments --- Tags: [#malware](https://daily.dev/tags/malware), [#blockchain](https://daily.dev/tags/blockchain), [#ransomware](https://daily.dev/tags/ransomware) [View this post on daily.dev](https://daily.dev/posts/deadlock-ransomware-uses-blockchain-to-resist-infrastructure-takedown-ay3u9m6e9) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"DeadLock ransomware uses blockchain to resist infrastructure takedown","url":"https://daily.dev/posts/deadlock-ransomware-uses-blockchain-to-resist-infrastructure-takedown-ay3u9m6e9","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/deadlock-ransomware-uses-blockchain-to-resist-infrastructure-takedown-ay3u9m6e9"},"datePublished":"2026-08-11T22:19:24.278Z","dateModified":"2026-08-11T22:19:53.258Z","description":"The DeadLock ransomware group, active since mid-2025, has adopted a novel decentralized infrastructure using the Polygon blockchain to store C2 configuration...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/88346bbaac73270e8629c1c21d0f78a5?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/88346bbaac73270e8629c1c21d0f78a5?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/deadlock-ransomware-uses-blockchain-to-resist-infrastructure-takedown-ay3u9m6e9","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"malware,blockchain,ransomware","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"DeadLock ransomware uses blockchain to resist infrastructure takedown"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/deadlock-ransomware-uses-blockchain-to-resist-infrastructure-takedown-ay3u9m6e9#faq","mainEntity":[{"@type":"Question","name":"How does DeadLock ransomware use the Polygon blockchain to avoid takedowns?","acceptedAnswer":{"@type":"Answer","text":"DeadLock stores its C2 chat-proxy address in a Polygon smart contract, retrieved via a read-only eth_call. This lets operators rotate the proxy without modifying the victim-facing HTML page, eliminating dependence on conventional domains that law enforcement can seize. Victim communications are encrypted via the Session network, and stolen data is hosted on Wasabi cloud storage, further distributing the infrastructure. Security teams tracking ransomware infrastructure evasion techniques find the latest threat intelligence on daily.dev."}},{"@type":"Question","name":"What encryption algorithm does DeadLock ransomware use to encrypt files?","acceptedAnswer":{"@type":"Answer","text":"DeadLock encrypts files using unique per-file XChaCha20 keys, each protected with Curve25519 elliptic-curve cryptography. Larger files are intermittently encrypted in 512-byte blocks to speed up the process while still rendering them largely irrecoverable. The ransomware caps itself at 29% of system memory and 70% of CPU to avoid triggering performance alerts during encryption. Defenders responding to ransomware incidents stay current on encryptor internals through daily.dev."}},{"@type":"Question","name":"Which countries does DeadLock ransomware avoid targeting?","acceptedAnswer":{"@type":"Answer","text":"DeadLock is configured to skip systems in former Soviet Union and Commonwealth of Independent States (CIS) countries, as well as Iran, Syria, Oman, and Yemen. Its known victims are predominantly European organizations across IT, mining, transportation, manufacturing, hospitality, and consumer goods sectors, with 80 organizations listed on its leak site by July. Threat intelligence on ransomware targeting patterns like these surfaces regularly for security teams on daily.dev."}}]} ```