DeadLock Ransomware Gang Hides C2 on Polygon Blockchain

A financially motivated ransomware gang called DeadLock has breached over 80 organizations across four continents. It's done something no other group had pulled off before - it moved its command-and-control infrastructure onto a public blockchain, making it harder for law enforcement to disrupt.

The gang uses the Polygon blockchain, specifically storing malicious configuration data in smart contracts. This technique is called EtherHiding and has been used by North Korean-linked threat actors and another botnet called Aeternum. However, DeadLock is the first financially motivated ransomware operation to use it as the core of a functioning double-extortion campaign.

Microsoft Threat Intelligence published a detailed technical breakdown of DeadLock's encryptor, which is written in Rust. The report describes a cryptographic design that is sound with no practical recovery path. The encryptor uses a three-layer hybrid scheme, generating a fresh 32-byte random key and a 24-byte nonce for each file, making it harder to recover data without the attacker's private key.

The gang also applies a tiered strategy based on file size, encrypting files smaller than 50 MB in full, but only encrypting large files in intermittent chunks. This makes detection harder still, as the machine continues functioning normally while encryption proceeds in the background.