The ransomware gang DeadLock has started using decentralized blockchain infrastructure to manage victim communications and data leaks, making its operations harder to shut down, according to a new report from Microsoft Threat Intelligence published this month. The group's recovery system combines the Session messaging network with blockchain-backed services that store and deliver resources throughout the extortion process, Microsoft said. The tech giant observed multiple threat actors deploying the ransomware, including affiliates for Lynx and INC ransomware.
DeadLock was first spotted in July 2025 and uses double extortion tactics—encrypting victim systems while threatening to publicly release stolen data. As of August 2026, the group has claimed 96 victims, most of them in Italy, Spain, Poland, Türkiye, and the U.S. The ransomware encrypts files with the ".dlock" extension, changes file icons using a custom ".ico" file, and modifies the victim's desktop wallpaper to display the message "Your infrastructure DeadLocked." It uses a hybrid cryptographic design combining Curve25519 elliptic-curve cryptography with the XChaCha20 stream cipher for file encryption. The malware includes geofencing to avoid execution in former Soviet and Commonwealth of Independent States countries as well as select Middle Eastern nations. It also features a resource-aware throttling mechanism that pauses encryption when memory usage exceeds 29% or CPU load exceeds 70%, while relying on AnyDesk for remote control of compromised hosts.
The most distinctive element is the ransomware's use of an HTML note dropped in all drive root directories and all Desktop folders. "Unlike the text note, the HTML note is a full interactive web application with a self-contained single-page application that implements end-to-end encrypted chat, a paginated data leak blog, and a file browser, all without requiring a traditional backend server," Microsoft said. The HTML file communicates with a server acting as a proxy, retrieving and managing the proxy details through blockchain technology. JavaScript code within the HTML file interacts with Polygon smart contracts for decentralized proxy server address rotation, turning them into censorship- and takedown-resistant infrastructure that lets the operator update the proxy URL without touching any victim-facing domains or registering domains. The recovery chat page also provides access to a data leak blog whose content is hosted on the Polygon blockchain, offering browsable access to leaked files without running a web server via the Wasabi protocol.
This architecture likely increases the resilience of portions of its communication, leak-hosting, and negotiation infrastructure, allowing DeadLock operators to recover from some disruption efforts while maintaining continuity for victims, according to the report. Microsoft noted that "this infrastructure model represents a meaningful evolution from traditional ransomware communication channels and poses new challenges for takedown efforts." The use of smart contracts to deliver proxy addresses represents an interesting method where attackers can apply infinite variants of this technique, Group-IB stated earlier this year. DeadLock has managed to keep a lower profile than its peers by not being associated with any known affiliate programs and for lacking a traditional data leak site, according to Group-IB's January analysis. The ransom note promises victims who pay will receive a decrypted file as proof, a "security report" detailing how attackers breached their network, security recommendations to prevent future attacks, and assurances they won't be targeted again. Law enforcement and security teams face a shifting landscape where traditional domain seizures and server takedowns may prove less effective against decentralized communication channels. Defenders will need to rethink incident response playbooks when negotiation infrastructure can simply regenerate through immutable ledger updates rather than collapsing when authorities act.