DeadLock Ransomware Weaponizes Blockchain to Evade Takedown

The ransomware landscape has undergone a disturbing evolution in 2026. Microsoft Threat Intelligence recently published a deep technical analysis of an emerging threat called DeadLock ransomware, a Rust-based encryptor that leverages decentralized infrastructure—including the Polygon blockchain and the Session messaging network—to resist takedown efforts and maintain uninterrupted communication with victims. The findings, released on August 10, 2026, reveal a level of operational sophistication that signals a new chapter in the ransomware threat ecosystem.

What Is DeadLock Ransomware?

First observed in July 2025, DeadLock is a financially motivated ransomware operation that employs double extortion tactics—encrypting victim environments while simultaneously threatening to publicly release exfiltrated data. As of July 2026, the operators have published more than 80 compromised organizations on their data leak site, with more than half of the claimed victims located in Europe. Affected sectors include information technology, mining, transportation and logistics, manufacturing, hospitality, and consumer goods across Europe, Asia, North America, South America, and Africa.

Microsoft has observed DeadLock being deployed by multiple threat groups, including an affiliate of the Lynx and INC ransomware ecosystems, suggesting the encryptor is offered or shared among established ransomware affiliates rather than operated by a single isolated group.

Technical Sophistication: A Closer Look at the Encryptor

Hybrid Cryptographic Design

The DeadLock encryptor implements a hybrid cryptographic scheme that combines Curve25519 elliptic-curve cryptography with the XChaCha20 stream cipher for file encryption. Key encapsulation uses the Networking and Cryptography Library (NaCl) crypto_box construction, which pairs an asymmetric key exchange with authenticated encryption to securely wrap each file’s symmetric key. Each file is encrypted with a distinct key derived from a per-file ephemeral key exchange, eliminating any possibility of key reuse across files. Microsoft notes that the cryptographic construction is sound and does not present a practical path to decryption without the attacker’s private key.

Resource-Aware Throttling

One of the most distinctive features of the DeadLock encryptor is its resource-aware throttling mechanism. The malware spawns a dedicated monitoring thread per drive batch that polls system memory and CPU utilization before dispatching each new file for encryption. If memory usage exceeds 29% or CPU load exceeds 70%, the dispatch thread pauses and retries until resources return below the thresholds. This approach prevents system hangs that would alert the user and reduces the likelihood of behavioral detection by maintaining normal-looking resource consumption patterns.

File Size-Based Encryption Strategy

To balance thoroughness with speed, DeadLock implements a tiered encryption policy based on file size:

• Files under 50 MB: 100% of the file is encrypted
• Files 50 MB to 118 MB: 50% encrypted in distributed chunks
• Files 118 MB to 500 MB: 25% encrypted in distributed chunks
• Files 500 MB to 1 GB: 10% encrypted in distributed chunks
• Files over 1 GB: Special chunked-full mode with calculated intervals

This intermittent encryption pattern renders files unusable while requiring only a fraction of the time needed for full encryption—a crucial optimization when targeting large databases, virtual machine images, and backups.

Defense Evasion and Geofencing

Before encryption begins, DeadLock takes aggressive steps to neutralize defenses. It terminates security tools including Windows Defender, Volume Shadow Copy and Backup services, backup and cloud sync applications like OneDrive and Dropbox, and remote access tools. It clears all Windows event logs through three complementary methods—direct clearing, registry-based disabling, and modern API enumeration—to eliminate forensic evidence. The malware also empties the recycle bin on all drives to eliminate a potential source of file recovery.

DeadLock implements language-based geofencing to avoid running in environments associated with former Soviet and Commonwealth of Independent States (CIS) countries, as well as select Middle Eastern countries. This pattern is commonly observed among ransomware operators believed to operate from those regions.

Decentralized Infrastructure: The Blockchain Revolution in Ransomware

The most groundbreaking aspect of DeadLock is its decentralized recovery infrastructure, which represents a meaningful evolution from traditional ransomware communication channels. The recovery chat system is built on three decentralized components:

Polygon Blockchain as Configuration Store

Rather than relying on traditional domain-based infrastructure that can be seized or taken offline, DeadLock operators store configuration data on the Polygon blockchain. Two smart contracts serve as censorship-resistant infrastructure: one stores the proxy server URL, and another stores the actor’s blog posts. The victim-facing HTML application issues read-only eth_call requests to public Polygon RPC endpoints to obtain the proxy server address and retrieve blog content. On-chain storage provides strategic advantages—the proxy URL can be updated by modifying the smart contract without changing any victim-facing infrastructure, and no domain registration or DNS infrastructure is required.

Session Network for End-to-End Encrypted Chat

For victim-operator communication, chat messages are routed through the Session decentralized messenger network, an onion-routed, swarm-based messaging protocol that provides anonymity for both parties. The victim’s Session identity is derived deterministically from their sign-in credentials, meaning no account registration is needed. If the victim forgets their credentials, the identity is unrecoverable. Messages are padded, signed with Ed25519, sealed with Curve25519 keys, and wrapped in Session’s onion request format before being submitted to swarm nodes via a proxy server.

Wasabi File Hosting for Data Leaks

The recovery chat page also provides access to a data leak blog whose content is stored on the Polygon blockchain. Blog posts support BBCode formatting, image galleries, and file attachments using either direct URLs or Wasabi protocol links. The HTML application contains a full AWS S3-compatible file browser that parses Wasabi credentials from the URI, generates AWS4-HMAC-SHA256 signed requests, lists bucket contents, and generates pre-signed download URLs—allowing the attacker to host stolen data on Wasabi and provide victims or the public with browsable access without running a web server.

Why This Matters: The Broader Threat Landscape

The DeadLock analysis arrives amid a surge of ransomware activity in 2026. According to the Google News trending headlines from August 2026:

• Check Point Research published “The State of Ransomware Q2 2026” report, indicating continued high attack volumes
• Gunra ransomware was reported exploiting Fortinet FortiOS and FortiProxy vulnerabilities to breach networks
• Surfshark reported that 92% of malware detections in 2026 were on Windows devices, underscoring the platform’s continued dominance as a malware target
• Securelist published Q2 2026 Android and IoT threat statistics, highlighting expanding attack surfaces
• A new Android malware was identified by Malwarebytes that allows criminals to use victims’ bank cards in real time

The convergence of these trends—ransomware adopting blockchain infrastructure, mobile malware enabling real-time financial fraud, and Windows remaining the dominant malware target—paints a picture of an increasingly sophisticated and diversified threat landscape. DeadLock’s use of decentralized infrastructure is particularly concerning because it poses new challenges for law enforcement takedown efforts. Traditional approaches of seizing domains or shutting down servers are ineffective when configuration data lives on a public blockchain and communications are routed through an onion-routed messaging network.

How to Defend Against DeadLock and Similar Threats

Microsoft recommends several mitigation strategies to reduce the impact of DeadLock and similar ransomware threats:

• Enable cloud-delivered protection in your antivirus solution to cover rapidly evolving attacker tools and techniques. Cloud-based machine learning protections block the majority of new and unknown variants.
• Run endpoint detection and response (EDR) in block mode so that threats can be blocked even when your primary antivirus does not detect them.
• Enable tamper protection to prevent attackers from stopping security services—DeadLock specifically targets windefend, vss, and other defensive services.
• Configure Controlled Folder Access policies to protect valuable data by preventing unauthorized write access to system folders. This can be enabled proactively on sensitive assets.
• Enable attack surface reduction rules, including blocking executable files from running unless they meet prevalence, age, or trusted list criteria, and blocking process creations from PSExec and WMI commands.
• Maintain offline backups—DeadLock empties the recycle bin, deletes volume shadow copies, and terminates backup services, so offline or immutable backups are essential.
• Practice credential hygiene and follow human-operated ransomware mitigation guidance to prevent initial access.
• Configure automatic attack disruption in your extended detection and response (XDR) platform to contain attacks in progress and limit impact.

The Road Ahead

DeadLock ransomware represents a significant milestone in the evolution of cybercrime operations. By combining proven ransomware tradecraft with decentralized infrastructure—blockchain-based configuration stores, onion-routed messaging, and S3-compatible cloud hosting—it has created a communication and extortion system that is significantly more resilient to takedown efforts than traditional approaches. The fact that it is shared among multiple ransomware affiliates amplifies its potential impact.

For organizations, the message is clear: the ransomware threat is not static. Attackers are continuously innovating, adopting technologies like blockchain to make their operations harder to disrupt. Defense must evolve at the same pace. Robust endpoint protection, immutable backups, attack surface reduction, and proactive threat hunting are no longer optional—they are the minimum baseline for survival in an era where ransomware operators are building infrastructure designed to outlast takedown attempts.

Microsoft Defender Antivirus detects DeadLock as Ransom:Win32/Deadlock.*. Organizations are encouraged to review the indicators of compromise published by Microsoft Threat Intelligence and ensure their security posture accounts for this evolving threat.

---

Edited by Palawan @QUE.COM
Website: https://QUE.COM Intelligence
Sponsored by: https://MAJ.COM AI Autonomous