DeadLock Ransomware Campaigns Leveraging Blockchain‑Backed Infrastructure

Du'aine Davis

Observed in the wild

• Since mid‑2025, the DeadLock ransomware group has targeted organisations globally with file encryption, data theft and extortion. Victims receive evolving ransom notes and embedded Session‑based chat interfaces. The actor operates without a DLS but threatens to sell stolen data. Group‑IB observed multiple variants between June–August 2025, with infections identified in India, Spain and Italy.
• DeadLock employs PowerShell service‑stopping scripts, deletion of shadow copies, CMD execution, and AnyDesk for remote control. Its key innovation is using Polygon smart contracts to store and rotate proxy/C2 addresses, retrieved through JavaScript embedded in ransom‑note HTML. This decentralised technique complicates takedown and mirrors emerging trends such as DPRK‑linked “EtherHiding”.
• Organisations should harden endpoints with Microsoft Defender behavioural detections for ransomware patterns (service‑stopping, shadow‑copy deletion, suspicious PowerShell, AnyDesk misuse). Implement MFA, continuous patching, backups, and employee training.

DeadLock Ransomware: Smart Contracts for Malicious Purposes | Group-IB Blog