DeadLock Ransomware Turns Polygon Into a Resilience Layer for Extortion

DeadLock ransomware is changing where defenders need to look during an incident. Instead of relying only on conventional web infrastructure, it uses decentralized services that make parts of its communication and extortion workflow more resilient to disruption.

Microsoft reported that DeadLock combines Session messaging with blockchain-backed services. Its recovery chat application queries Polygon smart contracts for current proxy information, which operators can update on-chain.

On affected endpoints, DeadLock stops selected services, disrupts recovery options, encrypts files, drops ransom notes, and changes the desktop wallpaper. Defenders therefore need to address both destructive endpoint activity and decentralized extortion infrastructure.

DeadLock moves resilience beyond the encryptor

DeadLock uses blockchain to strengthen its post-compromise infrastructure rather than its encryption process. Its recovery chat application queries Polygon smart contracts through read-only calls to retrieve the current proxy URL, which operators can update on-chain without changing the victim-facing HTML.

This reduces reliance on infrastructure commonly targeted during disruption efforts, such as:

• Domains and DNS infrastructure
• Centralized hosting
• Communication servers

The approach makes parts of DeadLock’s blockchain ransomware infrastructure more resilient to conventional takedowns. However, it still depends on a reachable custom proxy, public Polygon RPC endpoints, and off-chain services such as Wasabi for leaked files. These dependencies leave defenders with potential disruption opportunities.

What happens after DeadLock reaches a Windows endpoint?

DeadLock prepares Windows systems by deleting backups, stopping selected virtualization-related services, clearing the Recycle Bin, and targeting non-system directories for encryption.

The Rust-based encryptor uses Curve25519 and XChaCha20 with per-file keys. It intermittently encrypts larger files, then adds a victim-specific identifier and .dlock extension, drops ransom notes, changes file icons, and replaces the desktop wallpaper.

DeadLock also limits CPU and memory use, which can keep affected systems relatively responsive while encryption continues.

Signals that deserve immediate investigation

Teams investigating DeadLock ransomware should correlate these signals with confirmed endpoint or incident evidence rather than treat Polygon or Session activity alone as malicious.

Double extortion makes encryption only part of the incident

DeadLock uses double extortion, encrypting systems while threatening to publish stolen data. As of July 2026, operators had listed more than 80 compromised organizations, with DeadLock activity affecting sectors including IT, mining, transportation, manufacturing, hospitality, and consumer goods.

Restoring encrypted systems therefore addresses only part of the incident. Security teams should also investigate:

• Data staging or unusual outbound transfers
• Compromised accounts and administrative credentials
• Remote execution or management activity
• Access to sensitive repositories
• Backup or recovery changes
• Related activity across other endpoints

Microsoft has not identified one universal initial-access method for DeadLock. Response teams should base their investigation on evidence from the affected environment rather than assume a specific entry vector.

Containment still begins where the ransomware executes

DeadLock’s decentralized infrastructure complicates disruption, but defenders still need to stop malicious endpoint activity. Organizations responding to DeadLock ransomware should prioritize execution control and endpoint containment while investigating the broader communication and extortion infrastructure.

Microsoft recommends cloud-delivered antivirus protection, EDR in block mode, tamper protection, automated investigation and remediation, Controlled Folder Access, and attack-surface reduction rules, including controls targeting PsExec and WMI activity.

Teams should also:

• Isolate affected endpoints when evidence indicates malicious activity.
• Protect backup infrastructure and restrict administrative access.
• Investigate destructive file and process activity that may precede encryption.
• Rotate exposed credentials when evidence indicates compromise.
• Preserve forensic evidence before rebuilding affected systems.
• Validate backups and recovery procedures before restoring affected environments.

Featured resource

The Cybersecurity Blueprint

Practical cybersecurity blueprint for choosing, implementing, and strengthening the right business security strategy.

DOWNLOAD

Where Hexnode fits into DeadLock response

Hexnode XDR can support Windows endpoint investigation and endpoint containment during ransomware incidents. Security teams can review process trees and endpoint telemetry, quarantine or delete identified threat files, terminate malicious processes or process trees, and isolate affected endpoints while retaining the XDR management connection.

For ransomware response, teams can use these capabilities to:

• Investigate suspicious process and file activity
• Quarantine identified malicious files
• Terminate malicious processes or process trees
• Isolate affected Windows endpoints
• Continue remediation through the XDR console

Hexnode UEM can complement these controls with Windows patch and update management, application compliance monitoring, and device compliance policies. These capabilities support patch governance and endpoint compliance, but they do not replace DeadLock-specific threat intelligence, backup protection, identity investigation, network telemetry, or forensic analysis.

DeadLock’s real lesson is infrastructure diversity

DeadLock shows why disrupting conventional infrastructure may not dismantle an entire DeadLock ransomware extortion operation.

Its use of Polygon-based configuration and Session messaging makes parts of its communication and extortion infrastructure more resilient, although its proxy and external file hosting remain potential disruption points.

Enterprises should focus on what they can control directly: endpoint visibility, rapid containment, protected backups, credential hygiene, and tested recovery procedures.