DeadLock, a ransomware operation that BleepingComputer says emerged in mid-2025, is using blockchain-backed infrastructure to reduce its dependence on systems that defenders and law enforcement can more easily seize or take offline. According to BleepingComputer’s report on Microsoft research, the group is using decentralized services to support communications with victims and activity on its data-leak site. The core change is architectural. BleepingComputer reports that DeadLock uses the Polygon blockchain to store configuration data and posts for its leak site. Rather than relying only on a fixed Tor address, the victim-facing HTML page retrieves the current chat-proxy address by querying a smart contract on Polygon through a read-only `eth_call`. That matters because it gives the operators a way to change the chat proxy without changing the victim-facing application, according to the report. In practical terms, the infrastructure can be re-pointed through data stored on-chain, reducing dependence on conventional domains and web servers that can be taken down. BleepingComputer notes that blockchain-based command-and-control addressing has become common among cybercriminals, but remains rare in ransomware. DeadLock also uses the decentralized Session network to encrypt victim communications, and provides access to stolen files hosted on Wasabi’s cloud service, according to the report. The resilience is not absolute. Microsoft noted, via BleepingComputer, that DeadLock communications still require a custom proxy, that public Polygon remote procedure call endpoints must remain reachable, and that files hosted on Wasabi can be removed. The design raises the takedown cost, but it does not eliminate infrastructure dependencies. The operation appears to be targeting real organizations at scale. By July 2026, DeadLock’s leak site listed 80 organizations, mostly in Europe, according to BleepingComputer. The listed victims span IT, mining, transportation, manufacturing, hospitality, and consumer goods. Microsoft researchers also observed the malware being deployed by multiple groups, including an affiliate previously linked to the Lynx and INC ransomware ecosystems, BleepingComputer reports. That suggests DeadLock’s tooling is not necessarily confined to a single tightly held operator, though the cluster provides no additional detail on affiliate structure. The ransomware itself follows a familiar double-extortion model: steal data, encrypt files, then pressure victims to pay. BleepingComputer says the malware is configured to avoid countries in the former Soviet Union and Commonwealth of Independent States region, as well as Iran, Syria, Oman, and Yemen. On infected Windows hosts, the locker deletes backups, stops virtualization, empties the Recycle Bin, and encrypts selected non-system directories. BleepingComputer reports that it uses unique per-file XChaCha20 keys protected with Curve25519, limits resource use to up to 29% of available memory and 70% of CPU, and intermittently encrypts larger files in 512-byte blocks to speed the process while leaving them largely unrecoverable. Encrypted files receive a victim-specific identifier and the `.dlock` extension, with ransom notes and a changed desktop wallpaper indicating the system has been locked. Who benefits: DeadLock operators and affiliates benefit from infrastructure that is harder to disrupt through conventional domain or server takedowns. The setup may also help them keep victim communications running while changing proxy endpoints. Who's exposed: Organizations in the sectors BleepingComputer lists — IT, mining, transportation, manufacturing, hospitality, and consumer goods — are represented among DeadLock’s reported victims, mostly in Europe. The evidence does not establish that those sectors are the only targets.