The DeadLock ransomware group, identified in July 2025, employs blockchain-based methods to evade detection, distinguishing it from typical ransomware operations. Unlike the common double extortion approach, DeadLock does not have a data leak site to threaten victims with public exposure. Instead, it claims to sell stolen data on underground markets if ransoms aren’t paid, a tactic some experts consider dubious. The group’s notable innovation is using Polygon smart contracts to obscure its command-and-control (C2) infrastructure. This method allows frequent rotation of proxy server URLs, making it challenging for defenders to block the infrastructure permanently. After encrypting a victim’s systems, DeadLock provides an HTML file as a wrapper for the decentralized messenger Session, guiding victims to communicate via this platform. This technique of using smart contracts is gaining traction, with North Korean state-sponsored attackers employing similar methods, described as “EtherHiding,” to conceal malware, according to Google’s Threat Intelligence Group (GTIG). These methods represent a new evolution in cybercriminal tradecraft, offering a kind of bulletproof hosting. While DeadLock’s smart contract usage is well-documented, details about its initial access methods remain unclear. However, it is suspected to use techniques like bring your own vulnerable driver (BYOVD) and exploiting vulnerabilities to disable endpoint detection and response (EDR) systems, as noted by Cisco Talos.