DeadLock ransomware puts its leak site on Polygon to dodge takedowns

Most ransomware disruption starts with the same move: find the leak site, seize the domain, choke off the negotiation channel. DeadLock is built to make that move nearly pointless. Microsoft Threat Intelligence's teardown of the encryptor describes an operation whose recovery and leak infrastructure runs on the Polygon blockchain and the Session messenger, an architecture the company says is "significantly more resilient to takedown and censorship efforts" than the domain-based setups defenders are used to dismantling.

The recovery chat on a smart contract

When DeadLock encrypts a machine, it drops two ransom notes. The text note is unremarkable. The second, RECOVERY_CHAT.<UID>.html, is a full single-page application: end-to-end encrypted chat, a paginated data leak blog, and a file browser, all without a backend server.

The configuration lives on Polygon. One smart contract stores the chat proxy URL, another stores the blog posts with titles, bodies, timestamps, image URLs, and attachment links. The page fetches them with read-only eth_call requests to public Polygon RPC endpoints, cycling six of them for redundancy. It needs no wallet and makes no transactions.

That removes the pieces a disruption team normally grabs. The core setup has no domain registration and no DNS. To point victims at a new chat proxy, the operators update a contract field.

Session for chat, Wasabi for leaks

Victim-operator chat runs over the Session network, an onion-routed, swarm-based messenger. The victim's identity derives deterministically from the credentials they type into the page: same credentials, same keypair, no registration, and no recovery if those credentials are lost, as the chat UI itself warns. Messages are protobuf-encoded, padded, signed, sealed, and wrapped in Session's onion requests, relayed by a proxy whose address comes from the blockchain contract.

Leaked files use the same logic. Attachment links can point to Wasabi protocol URIs, and the HTML app embeds an AWS S3-compatible browser that parses credentials from the URI, builds AWS4-HMAC-SHA256 signed requests, and generates pre-signed download URLs. Stolen data becomes browsable with no web server to seize.

Microsoft lists the limits: the page still needs a reachable Polygon RPC endpoint, chat dies if the proxy goes dark, and images or files can be scrubbed from CDN or Wasabi hosting. But contract-stored blog data resists conventional hosting takedowns, and Session's swarm has no single server to unplug.

A throttled encryptor with sound crypto

The encryptor is careful engineering too. First observed in July 2025, DeadLock runs double extortion: it encrypts systems while threatening to publish the stolen data. A resource-aware throttling loop keeps the machine responsive during encryption, with a monitoring thread polling memory and CPU before each file dispatch and pausing via a waitable timer when memory usage exceeds 29 percent or CPU idle drops below 30 percent. That limits both user-visible hangs and the behavioral detection noise of a pegged CPU.

It also refuses to run where its operators likely sit. The configuration carries a language exclusion list covering Russian, Ukrainian, Belarusian, other languages spoken across former Soviet and CIS-linked countries, and several Middle Eastern ones. A matching system or UI language triggers immediate self-deletion before any encryption, a pattern Microsoft notes is common among ransomware operators believed to operate from those regions.

The cryptography holds up under review. Files are encrypted with XChaCha20, with keys wrapped through Curve25519 ECDH using the NaCl crypto_box construction and a fresh ephemeral keypair per file. Encryption scales by file size:

File size	Encryption
Under roughly 50 MB	100 percent
From roughly 50 MB	50 percent, distributed chunks
From roughly 118 MB	25 percent, distributed chunks
From roughly 500 MB	10 percent, distributed chunks
Above roughly 1 GB	Chunked-full mode

The tiered approach ruins databases and VM images in a fraction of the time full encryption would take. Microsoft's verdict is blunt: the design "does not present a practical path to decryption without the attacker's private key."

Operationally, DeadLock has been busy. Since July 2025 the operators have published more than 80 organizations on their leak blog, more than half of them in Europe. The victim list spans IT, mining, transportation and logistics, manufacturing, hospitality, and consumer goods across Asia, the Americas, and Africa as well. Microsoft says multiple groups deploy the encryptor, including an affiliate of the Lynx and INC ransomware ecosystems.

What changes for defenders

The takedown math is what changed. If a group can rebuild its victim-facing infrastructure by updating a contract on a public chain, the sinkhole-and-wait playbook stops being a decapitation strike. Microsoft's own guidance leans on blocking instead: cloud-delivered protection, EDR in block mode, tamper protection, automatic attack disruption, strict Controlled Folder Access, and attack surface reduction rules against PSExec and WMI. The patching side of the job has not gone away: CISA's must-patch catalog now includes an actively exploited Progress LoadMaster flaw.

The shift fits a pattern in our own analysis of the 2025 extortion wave, which found ransomware-as-a-service affiliates earning between $300,000 and $900,000 a year and critical infrastructure at 41 percent of incidents, up from 28 percent in 2023. DeadLock is what that industrialization looks like once takedown resistance becomes a design requirement.

None of the pieces is exotic; Polygon, Session, and Wasabi are public services. What's new is the assembly. Expect more groups to copy it: the design is working, and the takedown playbook has not caught up.