DeadLock Ransomware Leverages Blockchain for Evasion

Microsoft has exposed DeadLock's blockchain-powered ransomware setup, which uses decentralized services to evade disruption by law enforcement. The operation had listed around 80 victims by July 2026, mostly European organizations in various sectors.

The group utilizes the Polygon blockchain to store configuration data and content tied to its leak site, making it harder for authorities to seize traditional domains and servers.

DeadLock also employs the decentralized Session network for encrypted victim communications and Wasabi cloud storage for stolen data. The operation's architecture makes it more resilient but does not make it impossible to disrupt, according to Microsoft.