DeadLock skips throwaway domains entirely. Its victim chat and leak blog run on Polygon smart contracts, and Microsoft says that's exactly why takedown notices don't work on it anymore.
Take down a normal ransomware gang's infrastructure and you seize a domain, lean on a hosting provider, or get a registrar to pull the plug. DeadLock doesn't give you that option. According to Microsoft's technical breakdown published August 10, 2026, the group's victim-chat and leak-blog infrastructure runs on two smart contracts on the Polygon blockchain — and it can rotate across six different public Polygon RPC endpoints if any one of them gets blocked. There's no single domain to seize, because there isn't really a domain at all.
How it actually encrypts your files
Once DeadLock's Rust-compiled encryptor is running on a compromised machine, it doesn't brute-force through every file the same way. It checks size first. Files under roughly 50MB get fully encrypted. Files between about 50MB and 118MB get half-encrypted. Between 118MB and 500MB, a quarter. Anything bigger than 500MB gets just 10% of its content scrambled. That's not laziness — partial encryption on large files is a known ransomware efficiency trick, because scrambling one-tenth of a multi-gigabyte database still renders it completely unusable while taking a fraction of the time full encryption would.
The cryptography underneath is a hybrid scheme: XChaCha20 does the actual file-content encryption, while a Curve25519 elliptic-curve key exchange combined with XSalsa20-Poly1305 (the NaCl "crypto_box" construction) wraps a fresh, per-file ephemeral key. Generating a new key for every single file, rather than reusing one key for the whole run, is a deliberate defense against the kind of key-recovery tricks that have cracked weaker ransomware strains in the past. Encrypted files come out the other side renamed with a .dlock extension.
July 2025
First observed
Rust-based encryptor
80+
Leak-site victims
As of mid-2026, majority in Europe
.dlock
File extension
Applied after encryption
DeadLock throttles its own CPU and memory use mid-attack specifically so it doesn't trip the kind of alert a maxed-out server usually sends. · Unsplash
Why putting C2 on a blockchain actually works for them
Victims who get hit don't visit a .onion site or a dark-web forum link — they open a self-contained HTML file called RECOVERY_CHAT.<victim-ID>.html that DeadLock drops on the machine. That file is a full application: an end-to-end encrypted chat client running over the Session network (a decentralized, onion-routed messaging protocol), a paginated leak-blog reader that pulls its posts directly from one of the Polygon smart contracts, and a file browser pointed at Wasabi S3-compatible storage where the stolen data actually sits. Victim login credentials deterministically generate a Session messaging keypair, so there's no account registration step for either side — the chat identity is derived, not created.
Law enforcement's usual playbook against ransomware infrastructure — most visibly in the 2024 international takedown of LockBit's servers and leak sites — leans hard on seizing centralized infrastructure: domains, hosting accounts, forum access. A Polygon smart contract doesn't have a registrar to lean on, and DeadLock's ability to fail over across six separate public RPC endpoints means blocking access to the contract data through any single provider doesn't actually cut victims off from it. The chat and leak-blog layer keeps functioning as long as the Polygon network itself does, which is to say, indefinitely.
Old-school C2 vs. DeadLock's approach
Domain-based leak siteSingle point of failure
One registrar takedown or hosting seizure kills it
Tor/.onion leak siteHarder, not impossible
Survives domain seizure, still relies on relay/hosting cooperation
Polygon smart contract + 6 RPCsNo single kill switch
No registrar, no host, no single endpoint to block
There's also a tell buried in the malware's own defense evasion: it self-deletes if the infected machine's system language is set to Russian, Ukrainian, Belarusian, Persian, Armenian, Tajik, or several other former-Soviet and select Middle Eastern languages, and it geofences the same regions. That's one of the oldest and most consistent signals in ransomware attribution — operators who build in a hard rule against hitting their own back yard. It doesn't name a nationality with certainty, but it's a pattern this site has flagged before, including in Gunra's ransomware campaign against Fortinet VDI deployments and the SonicWall SMA 1000 intrusions that gave INC ransomware root access for weeks.
Enable EDR in block mode, not just detection mode — DeadLock's Defender signature (Ransom:Win32/Deadlock.*) only helps if the endpoint acts on it.
Turn on attack surface reduction rules that block PSExec and WMI-based lateral movement, DeadLock's primary spreading method once inside a network.
Keep backups genuinely offline or immutable — DeadLock actively targets backup software and cloud-sync processes before it starts encrypting.
Treat a ransom note's promises with the same skepticism regardless of how the group presents itself — a self-hosted chat client doesn't make a data-deletion promise any more binding, a lesson [River Bank's own ransomware negotiation](/river-bank-ransomware-attacker-data-deletion-promise-2026) already taught the hard way.
How DeadLock got here
July 2025
DeadLock's Rust-based encryptor is first observed in the wild.
Through mid-2026
The group's leak site grows to more than 80 listed organizations, over half of them in Europe, spanning IT, mining, transportation, logistics, manufacturing, hospitality and consumer goods.
August 10, 2026
Microsoft publishes a full technical breakdown of the encryptor and its Polygon-based recovery infrastructure, along with Defender detection signatures and mitigation guidance.
Quick questions
Can DeadLock's blockchain-based infrastructure be taken down at all?
Not the way a domain-based leak site can. The smart contracts and their addresses are public and traceable on-chain, but there's no registrar or single host to serve a takedown notice to, and DeadLock can fail over across six separate Polygon RPC endpoints if one is blocked.
Does paying the ransom actually decrypt files?
This piece isn't a payment-recommendation guide, and neither Microsoft's writeup nor independent reporting confirms DeadLock's decryption reliability. Treat any ransomware group's promises, including a data-deletion promise, as unverified by default.
What does .dlock mean if I find it on my files?
It's the extension DeadLock's encryptor appends after encrypting a file. Its presence, combined with a RECOVERY_CHAT.<ID>.html file, is a strong indicator of this specific strain rather than a different ransomware family.
Is using Polygon or blockchain technology itself the security risk here?
No — the blockchain is being used as resilient hosting for stolen data and a chat interface, not as an exploit vector. The underlying compromise still starts with normal intrusion methods like phishing, exposed credentials, or unpatched software.
The encryption in DeadLock isn't especially novel — XChaCha20 and Curve25519 are solid, well-understood primitives, not some breakthrough. What's new, and worth watching, is the infrastructure choice underneath it. If this generation of takedown-resistant leak sites works as well in practice as it looks on paper, expect to see the same Polygon-contract pattern showing up under other ransomware brand names within the year.
