In short
- Cybersecurity agency Group-IB has warned that ransomware household DeadLock is utilizing Polygon sensible contracts to distribute and rotate proxy server addresses, serving to it evade detection.
- The ransomware has stayed below the radar resulting from few victims, no associates program, and no public knowledge leak website.
- The approach mirrors Google’s disclosures final yr regarding “EtherHiding,” which abuses Ethereum sensible contracts to hide malware.
A newly found pressure of ransomware is utilizing Polygon sensible contracts for proxy server tackle rotation and distribution to infiltrate units, cybersecurity agency Group‑IB warned on Thursday.
The malware, dubbed DeadLock, was first recognized in July 2025 and has to this point attracted little consideration as a result of it lacks a public associates program and an information‑leak website and has contaminated solely a restricted variety of victims, in accordance with the corporate.
🚨 DeadLock Ransomware: When Blockchain Meets Cybercrime
Group-IB has uncovered a classy new risk rewriting the ransomware playbook. DeadLock leverages Polygon sensible contracts to rotate proxy addresses, a stealthy, under-reported approach that bypasses conventional… pic.twitter.com/rlPu9gZd5F
— Group-IB International (@GroupIB) January 15, 2026
“Though it’s low profile and but low affect, it applies revolutionary strategies that showcases an evolving skillset which could turn into harmful if organizations don’t take this rising risk severely,” Group-IB stated in a weblog.
DeadLock's use of sensible contracts to ship proxy addresses is “an attention-grabbing technique the place attackers can actually apply infinite variants of this system; creativeness is the restrict,” the agency famous. Group-IB pointed to a current report by the Google Menace Intelligence Group highlighting using an identical approach known as “EtherHiding” employed by North Korean hackers.
What’s EtherHiding?
EtherHiding is a marketing campaign disclosed final yr during which DPRK hackers used the Ethereum blockchain to hide and ship malicious software program. Victims are sometimes lured via compromised web sites—typically WordPress pages—that load a small snippet of JavaScript. That code then pulls the hidden payload from the blockchain, permitting attackers to distribute malware in a means that’s extremely resilient to takedowns.
Each EtherHiding and DeadLock repurpose public, decentralized ledgers as covert channels which can be tough for defenders to dam or dismantle. DeadLock takes benefit of rotating proxies, that are servers that often change the IP of a person, making it more durable to trace or block.
Whereas Group‑IB admitted that “preliminary entry vectors and different essential levels of the assaults stay unknown at this level,” it stated DeadLock infections rename encrypted recordsdata with a “.dlock” extension and substitute desktop backgrounds with ransom notes.
Newer variations additionally warn victims that delicate knowledge has been stolen and may very well be offered or leaked if a ransom shouldn’t be paid. No less than three variants of the malware have been recognized to this point.
Earlier variations relied on allegedly compromised servers, however researchers now imagine the group operates its personal infrastructure. The important thing innovation, nevertheless, lies in how DeadLock retrieves and manages server addresses.
“Group-IB researchers uncovered JS code throughout the HTML file that interacts with a sensible contract over the Polygon community,” it defined. “This RPC checklist incorporates the accessible endpoints for interacting with the Polygon community or blockchain, appearing as gateways that join purposes to the blockchain’s present nodes.”
Its most just lately noticed model additionally embeds communication channels between the sufferer and attacker. DeadLock drops a HTML file that acts as a wrapper across the encrypted messaging app Session.
“The principle goal of the HTML file is to facilitate direct communication between the DeadLock operator and the sufferer,” Group‑IB stated.
