Dead Lock Ransomware Uses Polygon Smart Contracts to Make Extortion Infra Harder to Disrupt
Summary: Microsoft Threat Intelligence reported that the DeadLock ransomware group uses the Session messaging network and blockchain-backed services, including Polygon smart contracts, to rotate proxy server addresses and host its data leak blog without registering domains. First detected in July 2025, the group has claimed 96 victims, mostly in Italy, Spain, Poland, Türkiye, and the U.S., and encrypts files with the ".dlock" extension using Curve25519 and XChaCha20.
What's compelling: Because the proxy addresses live in Polygon smart contracts rather than victim-facing domains, Microsoft says takedown efforts face new challenges and operators can recover from some disruption while keeping continuity for victims - a resilience problem for anyone whose incident response plan assumes seizing a server or a domain.
Read the original at The Hacker News ↗
- Topics
- Ransomware
- Related
- Ransomware Defense Using the Wazuh Open Source Platform Cyber Risks ·