DeadLock Leverages Polygon to Make Ransomware Harder to Stop

A Double-Extortion Operation with 96 Victims

DeadLock is a ransomware strain first detected in July 2025. The group encrypts Windows environments and threatens to publish stolen data.

This month, it has claimed 96 victims, primarily in Italy, Spain, Poland, Türkiye, and the United States. The first wave of cases was identified only in late May 2026.

Microsoft Threat Intelligence observed the malware being used by multiple threat actors, including affiliates linked to Lynx and INC ransomware. An analysis published in January described DeadLock as relatively less exposed than other groups: it was not linked to known affiliate programs and did not operate a traditional public data-leak site.

How the Malware Operates on Windows Systems

Encrypted files receive the .dlock extension. DeadLock also replaces icons with custom .ico files and changes the desktop wallpaper to display the message “Your infrastructure DeadLocked”.

Encryption uses Curve25519 and XChaCha20, but it is not applied indiscriminately: the malware excludes specific directories, extensions, and file names. To reduce the attack’s visibility, it limits resource consumption and stops operating when memory usage exceeds 29% or CPU load exceeds 70%.

The Windows variant may use PowerShell to:

• stop unauthorized services;
• prevent them from restarting;
• delete Volume Shadow Copies;
• remove the script used.

DeadLock also modifies the Windows Registry to disable event logging and deletes existing logs. After encryption, a batch file deletes the ransomware binary and then removes itself.

AnyDesk has been observed as a remote-access tool for controlling compromised hosts. No specific software versions have been disclosed.

Chat, Negotiation, and Polygon-Hosted Leaks

The most notable feature is the decentralized infrastructure. The malware places the file RECOVERY_CHAT.<UID>.html in the root directories of drives and on users’ Desktops.

This is a self-contained web application that includes:

• an interactive end-to-end encrypted chat;
• a paginated blog for publishing stolen data;
• a file browser;
• no traditional backend exposed to the victim.

The embedded JavaScript code interacts with smart contracts on the Polygon network to retrieve and rotate proxy-server addresses. Operators can therefore change URLs without updating the domains displayed to victims or their associated DNS records.

The data-leak blog is also hosted on the Polygon blockchain and loaded by the recovery page. This architecture complicates censorship, takedown efforts, and domain blocking.

The ransom note requires victims to use Session for communication and demands payment in Bitcoin or Monero. Before payment, operators may prove they possess the decryption key by returning a decrypted file. Some notes also promise a technical report on the intrusion and guidance to help prevent future attacks.

Useful Indicators for Incident Response

No specific patches or defensive procedures have been disclosed. Indicators to look for include:

• files with the .dlock extension;
• unusual .ico files and the “Your infrastructure DeadLocked” wallpaper;
• RECOVERY_CHAT.<UID>.html;
• suspicious PowerShell activity;
• deletion of Volume Shadow Copies;
• Registry modifications that disable logging;
• unexpected use of AnyDesk;
• deletion of binaries after encryption.

The impact is significant: in addition to making files unavailable, the attack can expose sensitive data, destroy recovery copies, and reduce the evidence available for forensic analysis. Decentralization does not make the ransomware invulnerable, but it allows communications to remain operational more easily even after traditional servers or domains are blocked.