DeadLock Ransomware Uses Polygon for Proxy Control

Cybersecurity researchers have uncovered a ransomware strain called DeadLock that exploits smart contracts on the Polygon blockchain to manage communications with infected systems, a technique that could complicate efforts to disrupt such attacks.

The operation, first detected in July 2025, relies on Polygon smart contracts to store and update proxy server addresses. These proxies serve as intermediaries for relaying encrypted messages between compromised machines and the attackers, allowing the group to maintain control without fixed command-and-control servers. According to a report from cybersecurity firm GroupIB released on January 15, 2026, the malware retrieves this configuration data through simple read operations on the blockchain, avoiding any transactions that would incur fees or leave a traceable footprint. Once a system is infected, DeadLock encrypts files, appending a .dlock extension, disables nonessential services, deletes volume shadow copies to hinder recovery, and replaces the desktop wallpaper with ransom instructions.

GroupIB analysts noted that the ransomware's design enables rapid infrastructure changes. Attackers can update proxy addresses stored in the...