DeadLock Ransomware Group Utilizes Polygon Smart Contracts

A newly emerged digital extortion group is using blockchain smart contracts to store proxy server addresses for facilitating ransomware negotiations with victim organizations.

See Also: The Complete Guide to the Latest MITRE ATT&CK Evaluations

The DeadLock ransomware group – it dates to July 2025 – has been using smart contracts on Polygon, a cryptocurrency blockchain platform designed to run alongside the ethereum blockchain.

Known as “EtherHiding,” the technique embeds malicious instructions in blockchain smart contracts. In many cases, such activities leave no trace. Devotees have included a North Korean nation-state group targeting developers and cryptocurrency firms and a financially motivated cybercrime group (see: Hackers Use Blockchain to Hide Malware in Plain Sight).

Researchers at ReversingLabs last fall detailed a campaign that used smart contracts to relay a URL to an infected endpoint, used by a malicious code dropper to download second stage malware.

DeadLock appears to have adopted EtherHiding just weeks after appearing, in this case for command-and-control purposes, said cybersecurity firm Group-IB in a in a report shared with Information Security Media Group. The first known crypto-locking malware binary used by the group, written in C++ and targeting Windows systems, was compiled in July 2025 and appears to mark the start of its activities.

Researchers said the crime group doesn’t maintain a data-leak site, relying instead on the anonymity-focused, end-to-end encrypted Session messaging system. It gives a Session ID to each victim. As a result, it’s tough to gauge how many victims the group may have amassed.

Group-IB said it’s found at least three different versions of the group’s ransomware. The latest includes an HTML file designed to act as a wrapper for Session communications. JavaScript inside the HTML file is designed to interact with the Polygon blockchain or network using a function called setProxy, and contains a remote procedure call list for doing so, with the function logic working its way through the list in case any are blocked.

The blockchain smart contract stores proxy server addresses which can be retrieved by the script without creating any transaction on the blockchain, which would incur a cost. The script executes a function called sendProxy that send requests to the proxy server at the received IP address. These requests include references to “swarms,” which is a term used by decentralized Session, and “snodes,” which may refer to session or service nodes, researchers said. Another function, sendMessage, encrypts and routes a user’s message as a JSON object to the proxy server.

The servers to which these URLs resolve involve a mix of systems running Vesta control panels, Shopware e-commerce platforms, cPanel control panels and WordPress installations, of which some appear to be hijacked and others created and hosted by the attackers themselves, Group-IB said.

Researchers identified multiple copies of DeadLock’s Polygon smart contracts, first created and updated in August 2025 and later updated in November 2025. “Since contract creation and setProxy transactions incur blockchain costs – even if minimal – the DeadLock operator needed to fund the address to afford these operations,” and used a wallet linked to the instant, fully automatic cryptocurrency exchange FixedFloat, the cybersecurity firm wrote.

Sophisticated Operation

As DeadLock’s use of EtherHiding suggests, the operation doesn’t appear to be comprised of ransomware neophytes.

Cisco Talos, in a recent research report also ascribed to DeadLock a very “sophisticated” approach to encryption, designed “to efficiently encrypt entire file systems while avoiding detections,” in part thanks to its use of “custom cryptographic implementations rather than standard Windows cryptographic APIs.”

The group’s attacks may also proceed over just a handful of days, further suggesting experienced operators are at work.

In one attack investigated by Cisco Talos, five days before unleashing DeadLock, the threat actor exploited CVE-2024-51324, a vulnerability in Baidu Antivirus that attackers can exploit using a “bring your own vulnerable driver” technique to terminate an arbitrary process, which in this case involved endpoint detection and response processes running on the system.

Investigators found that one day prior to encrypting the victim’s environment, the attacker installed AnyDesk remote desktop software – already used inside the target environment – on a host to give themselves persistent access. From there, the attacker activated remote desktop protocol and used it to move laterally across the network, disabled real-time protection in Windows Defender to stop it from submitting suspicious files for analysis, ran a PowerShell script designed to complicate recovery in part by deleting the system’s shadow copy, then unleashed ransomware inside the organization.

After rebooting, infected systems displayed wallpaper with the message: “Your infrastructure DeadLocked,” they said. Ransom notes added to every crypto-locked directory included a unique Session ID for the victim to make contact and discuss their ransom payment. Attackers threaten to also dump stolen data – making it a double-extortion attack – unless victims pay for a decryptor.