DeadLock Ransomware Uses Polygon Smart Contracts For Proxy Rotation
infosecurity-magazine.com Sep 7, 2026

DeadLock Ransomware Uses Polygon Smart Contracts For Proxy Rotation

AI-summarised brief · reviewed before publication

DeadLock, a ransomware group first identified in July 2025, has begun using Polygon blockchain smart contracts to store and rotate proxy server addresses for its command‑and‑control traffic. The malware retrieves proxy URLs through read‑only calls to a specific contract, avoiding hard‑coded servers and eliminating transaction fees that could reveal activity. Researchers at Group‑IB observed HTML files that contact victims via the encrypted Session messenger, with AnyDesk employed for remote access and PowerShell scripts used to halt services and erase shadow copies. Files are renamed with a .dlock extension and ransom notes threaten data sale. Multiple contracts linked to a single wallet, funded shortly before deployment, allow the attackers to update proxies on demand, complicating traditional blocking methods for cybersecurity teams.

💡 Why It Matters

  • · Hijacking a public blockchain for proxy rotation gives ransomware a resilient, low‑cost C2 channel that can be replicated, forcing defenders to redesign detection without harming legitimate decentralized use.