For years, ransomware disruption had clear technical targets. Investigators could seize servers, sink domains, remove leak sites, or take control of negotiation portals. Those actions could break parts of the criminal operation and force operators to rebuild. DeadLock shows a different design. Its extortion process spreads key functions across blockchain services, encrypted messaging, local HTML code, proxy relays, and cloud storage. A defender can remove one part of that system and still leave other parts able to function.
This changes what resilience means in a ransomware attack. Resilience is no longer limited to strong file encryption, damaged backups, or redundant command-and-control systems. It now includes the systems that let an attacker contact a victim, publish stolen data, replace failed infrastructure, and continue a negotiation after a disruption. DeadLock is a ransomware family, but its larger value to defenders comes from the architecture around the ransom demand.
The Older Ransomware Model Had Clear Choke Points
A common ransomware operation once depended on a fairly direct chain of infrastructure. An affiliate gained access through stolen credentials, an exposed service, phishing, or an initial access broker. The attacker moved through the network, stole data, disabled recovery options, and deployed an encryptor. The ransom note then sent the victim to a Tor-based negotiation site. A separate leak site gave the group public pressure against victims that did not pay.
This model could be highly resilient, but it still created central points that investigators could target. Servers hosted administration panels. Domains or onion services exposed victim portals. Back-end systems stored negotiation data. Leak sites hosted stolen material or links to it. Law enforcement could gain major leverage when it gained control of this infrastructure.
Operation Cronos against LockBit showed the value of that approach. In February 2024, an international operation compromised LockBit’s primary platform, took control of its leak site, and took down 34 servers across several countries. Authorities also gained decryption keys and intelligence from LockBit systems. The operation did not end ransomware as a business, but it showed how much damage a planned infrastructure seizure can cause when a criminal service depends on identifiable central systems.
DeadLock does not make that model obsolete. It shows how operators can reduce their dependence on it.
DeadLock Moves the Extortion Process Into Several Layers
Microsoft Threat Intelligence describes DeadLock as a financially motivated ransomware operation that uses decentralized infrastructure for victim communications and data leak activity. Microsoft first observed the ransomware in July 2025. By July 2026, DeadLock operators had published more than 80 compromised organizations on a DeadLock data leak blog, with victims across several industries and regions. Microsoft also observed DeadLock deployments by more than one group, including an affiliate linked to the Lynx and INC ransomware ecosystems.
The architecture after encryption is the part that sets DeadLock apart. The ransomware drops a file named RECOVERY_CHAT with a victim identifier and an HTML extension. This file is not a normal ransom note that points to a remote website. It is a self-contained browser application. Microsoft found that it contains an encrypted chat interface, a paginated leak blog, and a file browser. The application can run from the victim’s local system and obtain the remote information it needs from several external services.
That design changes the role of the ransom note. The note becomes a client application for the extortion service. The attacker no longer needs to give every victim a fixed portal address that points to one back-end system. The client can discover current infrastructure at run time.
Polygon Becomes a Configuration Layer
One of DeadLock’s most unusual design choices is its use of Polygon smart contracts as a configuration store. Microsoft identified one contract that stores the current chat proxy address and another that stores data for the DeadLock blog. The local HTML application can send read-only calls to public Polygon Remote Procedure Call endpoints and retrieve the data it needs. These calls do not require a victim to own cryptocurrency or use a wallet.
Group-IB had documented an earlier form of this behavior in January 2026. Its researchers found JavaScript in the DeadLock HTML file that queried a Polygon smart contract for a proxy URL. They also found transactions that changed the value used by the contract’s proxy function. This gave the operators a way to replace a failed proxy and direct existing victim applications to a new address. Group-IB described the use of smart contracts for proxy address rotation or distribution as an underreported technique.
The defensive problem is easy to see. A traditional block rule works well when the malicious application always contacts one domain or one fixed server. DeadLock can move the current proxy value into a public blockchain record and change that value when needed. The HTML file on the victim system does not need to change. The victim does not need a new ransom note. DNS does not need to point to the new service.
This does not make the infrastructure impossible to disrupt. It makes a single infrastructure action less final.
The Negotiation Channel Does Not Depend on a Normal Chat Server
DeadLock also uses Session for victim communication. Session is a decentralized messaging system that uses onion routing and distributed service nodes. In Microsoft’s analysis, the proxy URL retrieved from Polygon acts as a relay between the browser-based DeadLock chat and the Session network. The victim’s chat identity is created from credentials entered into the HTML application, which removes the need for a normal account registration process.
This is a different operating model from a negotiation portal hosted by the ransomware group. The attacker still needs reachable infrastructure, but the communication path is split across several components. The local HTML handles the user interface and cryptographic logic. Polygon provides current configuration data. A replaceable proxy relays requests. Session provides the messaging layer.
Group-IB’s earlier analysis reached a similar finding. The HTML wrapper sent encrypted message data through a proxy and used a destination value that matched the DeadLock Session identifier. The same research showed that the HTML code could cycle through several Polygon RPC endpoints if one endpoint failed or was blocked.
For a defender, the distinction matters. Removing one web server may stop one path, but it may not destroy the communication system. The attacker can replace the proxy, use another public RPC endpoint, or keep data available through a distributed service.
The Leak Site Is Also Being Split Apart
DeadLock applies the same idea to data exposure. Microsoft found that the HTML application can retrieve blog content from Polygon and can browse stolen files stored through Wasabi’s S3-compatible object storage. The local browser code can parse storage information, list files, move through folders, and generate links for individual objects. This lets the attacker present stolen data without placing the complete leak experience on one criminal web server.
The practical effect is a separation of functions. The victim-facing application exists as a local file. Blog metadata can come from a smart contract. Stolen files can exist in object storage. Communication can pass through Session. A proxy can connect some of these parts and can be replaced.
This is closer to a distributed application than a classic ransomware portal. That comparison should not be taken too far. DeadLock still has central dependencies. The proxy can fail. Public RPC access can be restricted. Object storage providers can remove malicious content. Session traffic can be detected or restricted in some environments. Microsoft states directly that the system is more resistant to disruption but is not independent of off-chain infrastructure.
The point is not that DeadLock cannot be taken down. The point is that defenders may need to disrupt several separate services before the extortion workflow stops.
Takedowns Can Become Degradation Instead of a Clean Break
This design has direct implications for law enforcement and incident response. Traditional ransomware infrastructure often gave investigators high-value seizure targets. Control of a primary panel, key server, leak site, or negotiation system could expose victims, affiliates, keys, logs, and internal records at the same time.
DeadLock reduces the amount of value stored in any one visible place. Some state can live on a public blockchain. The victim portal can live on the victim’s own disk. Messaging can use a distributed network. Stolen files can sit in commercial object storage. Proxies can rotate.
A successful takedown can still remove infrastructure and create cost for the operator. It can still expose accounts, servers, wallets, log data, and human mistakes. The change is in expected continuity. A ransomware operation can now plan for the loss of a server as an operational event instead of a catastrophic failure.
That is the broader lesson from DeadLock. Ransomware groups are starting to apply redundancy to the business process of extortion.
The Defensive Goal Must Move Earlier in the Attack
Security teams cannot depend on breaking the ransom portal after encryption. By that point, the attacker may already have the data, credentials, remote access paths, and communication system needed to keep pressure on the victim.
The better control point is earlier in the intrusion. Identity telemetry can expose unusual sign-ins, token abuse, impossible device changes, or privilege escalation. Endpoint detection can identify credential dumping, service tampering, shadow copy deletion, remote administration tools, and encryption behavior. Network controls can identify large outbound transfers, new object-storage destinations, unusual RPC traffic, or unexpected access to anonymizing and messaging services. Backup systems need isolation from normal administrative credentials and from the same trust paths used by production systems.
Remote access deserves close attention in this case. Group-IB found evidence that linked AnyDesk to DeadLock activity and identified scripts that appeared to preserve AnyDesk during service termination. Microsoft later found remote access tools such as AnyDesk, RustDesk, and Windows Remote Desktop in DeadLock’s process stop list, which shows that tool handling can differ across samples and stages. Security teams should focus less on one product name and more on unauthorized remote control, unexpected persistence, new service creation, and unusual remote sessions.
Off-host logging also becomes more valuable. Microsoft found that the analyzed DeadLock sample tried to clear and disable Windows event log channels before encryption. Logs that remain only on the compromised endpoint can disappear at the exact time that responders need them. Centralized identity logs, EDR telemetry, network records, cloud audit data, and remote log storage give responders evidence that the encryptor cannot erase from one host.
Outbound Monitoring Becomes Part of Ransomware Defense
Many ransomware programs still focus most of their attention on inbound access and endpoint encryption. Extortion resilience makes outbound traffic just as relevant.
A security team should know which systems can make direct Internet connections, which applications can reach public blockchain RPC services, where large file transfers can go, and which remote messaging or anonymity networks are permitted. This does not mean that an organization should block all blockchain traffic. Public blockchain infrastructure has legitimate uses, and a single technology block can create false confidence. The goal is to detect the sequence of behavior that does not fit the host or user.
For example, a workstation that has no business reason to contact Polygon RPC endpoints, followed by requests to an unknown proxy and traffic tied to an unauthorized local HTML application, creates a stronger signal than any one connection alone. The same principle applies to object storage. A large transfer to a new storage provider can be more useful to a defender when it is correlated with privilege changes, archive creation, RMM activity, or security control tampering.
This is where detection engineering becomes central to extortion defense. Infrastructure indicators still matter, but behavior can survive a proxy change, a new domain, or a new smart contract address. Detection logic should connect identity, endpoint, network, and cloud events across the attack path.
Incident Plans Must Assume the Attacker Can Keep Talking
DeadLock also creates a less technical problem. Many incident plans treat ransomware communication as a fixed portal that the response team can isolate, preserve, and study. A distributed recovery application changes that assumption.
Responders need a controlled process for handling ransom notes, HTML applications, Session identifiers, proxy addresses, smart contract references, and storage links. Analysts should preserve these artifacts before opening them on a production system. Teams should use isolated analysis environments for any interaction with attacker-provided code. Legal counsel, executive leadership, insurers, incident response providers, and law enforcement contacts should know who has authority to communicate and who must preserve evidence.
Organizations also need a plan for the case in which an attacker portal disappears and later returns through a different route. Loss of one contact path does not prove that the attacker lost access to stolen data. Loss of a leak site does not prove that public disclosure is no longer possible. A disruption should be treated as a change in the incident, not proof that the extortion risk has ended.
DeadLock Is a Warning About Ransomware Architecture
DeadLock is still ransomware. It encrypts files, steals data, destroys recovery options, and demands payment. Its deeper significance comes from what sits around the encryptor.
The group has treated extortion as a service that needs continuity. The local HTML application keeps the victim interface available. Polygon stores configuration and blog data. Session supports encrypted communication. Replaceable proxies connect the browser to the messaging service. Object storage gives the attacker another place to expose stolen data. No single piece makes the operation resistant to every disruption. Together, the pieces reduce dependence on one server or one portal.
Takedowns still work. Operation Cronos proved that infrastructure seizures can damage a major ransomware service, expose internal systems, recover keys, and reduce criminal capacity. DeadLock shows why future operations may require more targets and more coordination. The objective may shift from taking one site offline to breaking a chain of services that can replace or route around each other.
For defenders, the response is not to chase every new blockchain address after an attack. The response is to reduce the attacker’s time inside the environment, contain identity abuse earlier, detect unauthorized remote access, protect backups, monitor exfiltration, preserve off-host telemetry, and prepare incident teams for communication systems that can survive the loss of a conventional server.
How Can Netizen Help?
Founded in 2013, Netizen is an award-winning technology firm that develops and leverages cutting-edge solutions to create a more secure, integrated, and automated digital environment for government, defense, and commercial clients worldwide. Our innovative solutions transform complex cybersecurity and technology challenges into strategic advantages by delivering mission-critical capabilities that safeguard and optimize clients’ digital infrastructure. One example of this is our popular “CISO-as-a-Service” offering that enables organizations of any size to access executive level cybersecurity expertise at a fraction of the cost of hiring internally.
Netizen also operates a state-of-the-art 24x7x365 Security Operations Center (SOC) that delivers comprehensive cybersecurity monitoring solutions for defense, government, and commercial clients. Our service portfolio includes cybersecurity assessments and advisory, hosted SIEM and EDR/XDR solutions, software assurance, penetration testing, cybersecurity engineering, and compliance audit support. We specialize in serving organizations that operate within some of the world’s most highly sensitive and tightly regulated environments where unwavering security, strict compliance, technical excellence, and operational maturity are non-negotiable requirements. Our proven track record in these domains positions us as the premier trusted partner for organizations where technology reliability and security cannot be compromised.
Netizen holds ISO 27001, ISO 9001, ISO 20000-1, and CMMI Level III SVC registrations demonstrating the maturity of our operations. We are a proud Service-Disabled Veteran-Owned Small Business (SDVOSB) certified by U.S. Small Business Administration (SBA) that has been named multiple times to the Inc. 5000 and Vet 100 lists of the most successful and fastest-growing private companies in the nation. Netizen has also been named a national “Best Workplace” by Inc. Magazine, a multiple awardee of the U.S. Department of Labor HIRE Vets Platinum Medallion for veteran hiring and retention, the Lehigh Valley Business of the Year and Veteran-Owned Business of the Year, and the recipient of dozens of other awards and accolades for innovation, community support, working environment, and growth.
Looking for expert guidance to secure, automate, and streamline your IT infrastructure and operations? Start the conversation today.
Netizen Blog and News 
Leave a comment