Caution: New ‘DeadLock’ Ransomware Utilizes Polygon Smart Contracts for Stealth Operations

Cybersecurity experts are increasingly focused on a newly identified ransomware type known as DeadLock, which manipulates Polygon smart contracts to maintain its infrastructure unnoticed and evade traditional detection measures, according to a recent report from threat intelligence company Group-IB.

Key Takeaways

Emergence of DeadLock Ransomware: A new ransomware known as DeadLock uses Polygon smart contracts to avoid detection and maintain infrastructure stealthily.
Proxy Server Strategy: It employs smart contracts to store proxy addresses, facilitating communication while evading centralized control.
Evolution of Ransom Notes: Ransom notes have progressed to include threats of data theft and reassurance that victims won’t be targeted again.
Unique Communication Methods: DeadLock allows direct communication between victims and attackers through an embedded messaging interface, simplifying interaction.
Growing Cybercrime Trends: As cybercriminal activities linked to cryptocurrencies rise, significant sums have been stolen, highlighting the evolving landscape of online threats.

Caution: New ‘DeadLock’ Ransomware Utilizes Polygon Smart Contracts for Stealth Operations

DeadLock was first detected in July 2025 and has, until now, remained relatively obscure. Its stealthy nature stems from the absence of a public affiliate program, a data leak site, and a minimal number of confirmed victims linked to its operations.

However, this approach highlights a more advanced method that researchers believe reflects a broader trend in how cybercriminals are leveraging public blockchains for illicit purposes.

Understanding DeadLock’s Concealment Tactics

Group-IB’s examination reveals that DeadLock employs smart contracts on the Polygon network to manage and rotate proxy server addresses.

These proxies serve as intermediaries, connecting infected systems to ransomware operators, and enabling flexible command-and-control communication without relying on centralized systems that could be confiscated or obstructed.

The malware retrieves the current proxy address by querying the smart contract in a straightforward read operation that leaves minimal traceability and does not impose network costs.

This method resembles previous campaigns, such as EtherHiding, reported last year, where North Korean attackers utilized the Ethereum blockchain to hide and disseminate malware.

In both instances, public and decentralized ledgers were transformed into robust communication channels that are challenging for security professionals to disrupt. DeadLock’s use of Polygon enhances this strategy by integrating proxy management directly into a smart contract, enabling attackers to adjust their infrastructure as needed.

Proxy Management Diagram

Upon activation, DeadLock encrypts files, adds a “.dlock” extension, modifies system icons, and changes the victim's wallpaper to include ransom instructions.

Over time, the ransom notes have evolved. Early messages only mentioned file encryption, whereas recent versions explicitly warn of stolen sensitive data and threaten its public sale unless payment is made.

The latest ransom notes have also introduced “added services,” detailing how the network was breached and assuring victims they won’t be targeted again.

Unique Features of DeadLock: Not Just File Locking

Group-IB uncovered at least three distinct samples of DeadLock from mid-2025, each revealing progressive changes in tactics.

Analysis of related PowerShell scripts indicates that the malware aggressively disables unneeded services, removes volume shadow copies to hinder recovery efforts, and whitelists a limited selection of processes, notably AnyDesk.

Investigators suggest that AnyDesk functions as the primary tool for remote access during attacks, a conclusion supported by various digital forensic inquiries.

A fundamental component of DeadLock's approach is an HTML file dropped onto infected systems, featuring an encrypted messaging interface. Victims can communicate directly with the attackers through this file, eliminating the need for extra software.

DeadLock Interface

The embedded JavaScript retrieves proxy addresses from the Polygon smart contract and routes encrypted messages via these servers to a session ID controlled by the ransomware operators.

Transaction analysis reveals that the same wallet created multiple identical smart contracts and frequently updated proxy addresses using a function called “setProxy.”

This wallet was funded through an exchange-linked address shortly before the smart contracts were deployed, indicating careful preparation.

Historical analysis of these transactions enables defenders to reconstruct previous proxy infrastructure, although the decentralized nature complicates swift elimination efforts.

This discovery is part of a growing trend in crypto-related cybercrime, with over $3.4 billion stolen through hacks and exploits by early December 2025, and state-affiliated North Korean groups responsible for more than $2 billion of that total.