DeadLock: The ransomware that uses Polygon blockchain to hide itself

ConfusedWhale · 2026-02-07T18:25:29+00:00

The DeadLock ransomware has found an innovative way to evade security detection in Polygon smart contracts by using JavaScript to connect to RPC nodes and create communication channels that are difficult to block. With several variants, it highlights its use of encrypted messaging to extort victims, reflecting a concerning trend in cyber threats.

ConfusedWhale

2026-02-07 18:25:29

Abstract generation in progress

According to reports from Group-IB disseminated by Odaily, the DeadLock ransomware family has found a sophisticated strategy in Polygon smart contracts to evade security detection mechanisms. Since its first discovery in July 2025, this malware has demonstrated an unusual capability: integrating JavaScript code that interacts directly with the Polygon network, transforming blockchain technology into a concealment system for its criminal operations.

How DeadLock Exploits Smart Contracts to Distribute Commands

The technique used by DeadLock is particularly innovative in the context of cyber threats. By injecting code snippets into HTML files, the ransomware establishes a connection with Polygon’s RPC nodes, which serve as gateways to an infrastructure fully controlled by the attackers. This approach, similar to what was previously documented in the case of EtherHiding, allows the construction of communication channels that are extremely difficult for security experts to block.

The use of Polygon is no coincidence: the blockchain network offers transaction speed and low cost, features that make it an attractive platform for malware seeking covert operations. Through RPC lists, DeadLock continuously obtains new proxy server addresses, rotating its infrastructure so that monitoring systems encounter constant obstacles.

The Evolution of DeadLock: Expanding Variants and New Functionalities

So far, security analysts have identified at least three different variants of this ransomware. The most recent one incorporates a particularly concerning integration: the encrypted messaging application Session, which allows DeadLock operators to maintain direct and secure communication with victims, significantly increasing the sophistication of extortion operations.

This evolution reflects an alarming trend in the current cyber threat landscape: the use of decentralized technologies and encryption applications to enhance the operational capabilities of digital crime. DeadLock has not only demonstrated adaptability but also a level of engineering that suggests a group of attackers with significant technical resources and a deep understanding of how to exploit blockchain infrastructures for malicious purposes.

View Original

This page may contain third-party content, which is provided for information purposes only (not representations/warranties) and should not be considered as an endorsement of its views by Gate, nor as financial or professional advice. See Disclaimer for details.