DeadLock Ransomware’s Blockchain C2: How Polygon Smart Contracts Replace Traditional Infrastructure and Why Takedowns No Longer Work

Every ransomware takedown you have cheered for in the last three years relied on the same weakness: somewhere there was a server, a domain, or a Tor hidden service that a court order could reach. Hive, LockBit, ALPHV/BlackCat. All of them got unplugged because the plug existed. DeadLock’s operators looked at that pattern and did something genuinely uncomfortable to defend against. They moved the one piece of infrastructure that matters, the thing that tells every infected machine where to phone home, into an immutable Polygon smart contract that no agency on earth can delete.

The infrastructure problem every ransomware group has

Ransomware is not just an encryptor. It is a logistics business. You need a place for victims to negotiate, a place to publish stolen data as leverage, and a way for the payload to find its way back to you after it lands on a machine you have never seen. Historically all of that lived on infrastructure: bulletproof hosting, fast-flux domains, CDN fronting, Tor v3 onion services.

That infrastructure has been the kill switch. When the FBI and NCA ran Operation Cronos against LockBit in February 2024, they did not decrypt anything clever. They seized the panel, grabbed the affiliate data, and defaced the leak site with LockBit’s own branding. The disruption worked because there was a central nervous system to sever. Same story with Hive in January 2023, where the FBI sat inside the network for months and then took the servers. Same with the ALPHV seizure that the group briefly “un-seized” in a comical tug-of-war over a hidden service key.

Every one of those operations assumed the target had a physical or logical single point of failure. DeadLock’s architecture, disclosed in detail by Microsoft Threat Intelligence on August 10, 2026, is a direct answer to that assumption. The critical config does not live on a server anymore. It lives on a public blockchain, and that changes the calculus of what a “takedown” even means.

DeadLock: a group profile that already looks different

DeadLock first surfaced in July 2025. By August 2026 it had claimed 96 victims, concentrated in Italy, Spain, Poland, Turkiye, and the United States. It runs a double-extortion model, encrypting environments while threatening to publish exfiltrated data, but it does so without a conventional Data Leak Site and without an affiliate program. That combination is unusual. Most groups live and die by their affiliate ecosystem and their DLS brand.

Microsoft tied several DeadLock operators back to the Lynx and INC ransomware ecosystems. That lineage matters, because it tells you these are not blockchain hobbyists who wandered into extortion. These are experienced ransomware operators who deliberately re-engineered the part of the business that kept getting them dismantled. The malware also geofences the CIS region and several Middle-Eastern locales, the usual tell for operator origin, which means they built in the same “don’t burn the home turf” logic every serious crew uses.

Blockchain C2 is not new, but DeadLock crossed a threshold

Storing attacker data on a blockchain has been tried before. The evolutionary arc matters, because it shows the technique maturing from “cute trick for a single config string” into “the entire resilient backbone.”

Glupteba was the proof of concept. Its bots scanned the Bitcoin blockchain and pulled a new C2 domain out of OP_RETURN whenever a server died. Clever, but slow and limited: OP_RETURN gives you 80 bytes and Bitcoin blocks take ten minutes. EtherHiding in 2023 was the real conceptual leap, because a smart contract can hold arbitrary data in storage slots and can be updated at will. EtherRAT and Aeternum proved that model scales cheaply for botnet command delivery.

DeadLock is where this stops being a research curiosity. It is the first case where a ransomware group put the resilient rotation logic and the leak-publication layer on-chain as the primary infrastructure, not a fallback. That is the threshold: blockchain is no longer the backup channel that kicks in after your domain gets sinkholed. It is the domain.

The Polygon smart contract architecture

DeadLock’s core infrastructure is two Polygon smart contracts, and understanding the split between them is the whole game.

Contract 1, the proxy rotator. This contract stores the current proxy server URL in contract storage. After encryption, DeadLock drops a victim-facing HTML wrapper on the machine. That HTML contains JavaScript that talks to the Polygon blockchain and, using a function Group-IB documented as setProxy on the operator side, retrieves the current proxy address on the victim side. When an infected machine checks in, the JS queries public Polygon RPC endpoints and gets back the latest proxy. No wallet. No signed transaction. No gas. The client just reads.

The mechanism under the hood is eth_call, a read-only JSON-RPC method. The RPC endpoint returns an ABI-encoded hex blob. The client-side JavaScript decodes it into a plain string, which resolves to something like hXXp://138.226.236[.]51/p. Group-IB verified that exact flow. The important part: eth_call never touches the mempool, never creates a transaction, and costs nothing. It is functionally a free, censorship-resistant DNS lookup that no registrar can pull.

Contract 2, the leak blog. The second contract hosts the group’s blog posts and stolen-data listings on-chain. This is DeadLock’s answer to the DLS-seizure problem. You cannot send a hosting-provider abuse notice to a smart contract. There is no takedown form.

Here is the practical mechanics of the split. The operator can rotate the proxy URL any time by sending one setProxy write transaction, and every one of the deployed HTML wrappers, everywhere, picks up the new address on its next check-in. The operator never has to redistribute the payload. The victim HTML is static and dumb; the intelligence lives on-chain.

A minimal version of Contract 1 looks like this, and you can deploy it on a local Hardhat or Ganache node to study the behavior without touching real Polygon:

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;
// LAB USE ONLY - local Hardhat/Ganache network
contract ProxyRotator {
    string private proxyUrl;
    address public owner;

    constructor() { owner = msg.sender; }

    function setProxy(string calldata _url) external {
        require(msg.sender == owner, "Not owner");
        proxyUrl = _url;
    }

    function getProxy() external view returns (string memory) {
        return proxyUrl;
    }
}

getProxy is marked view, which is why calling it costs nothing: view functions are served by eth_call and never mutate state. setProxy is the only function that writes, and only the owner can call it.

Victim communications do not stay on-chain. Once the HTML wrapper has the proxy, it steers victims to Session, the decentralized messenger. A victim’s Session identity is derived deterministically, so the account only materializes when they enter their credentials. That means no persistent operator identity sitting on Session waiting to be enumerated.

Exfil hosting is the one soft spot. Stolen archives sit on Wasabi, an S3-compatible object store, and Wasabi files can be removed. Microsoft was explicit about this residual weakness: the communications path still routes through a custom proxy, and the exfil files can be pulled. But neither of those is the resilient core. The proxy rotation on Polygon is the thing that survives everything.

Gas economics: the asymmetry is the point

The economics are almost insulting to the defensive side.

The read path costs the attacker nothing. Every victim machine calling eth_call to fetch the proxy URL pays zero gas, because reads are served off a node’s local state and never go on-chain. You could have ten thousand infected hosts polling the contract and the operator’s bill stays flat.

The write path, the only part that costs money, is trivially cheap. On Polygon, transaction fees are paid in MATIC, and a proxy rotation is a single small storage write. Unit 42’s Aeternum analysis pinned the number: roughly one dollar of MATIC buys 100 to 150 command transactions on Polygon. Deploying the contract in the first place costs about a dollar and requires, in Microsoft’s own framing, minimal technical knowledge.

Now compare that to the defensive cost. An operation like Cronos involved multiple national agencies, months of infiltration, coordinated seizure across jurisdictions, and legal process for every server and domain. Set that multi-agency, multi-million-dollar effort against an adversary whose entire resilient infrastructure costs about a dollar to stand up and pennies to rotate. That asymmetry is not a footnote. It is the strategic reason this model spreads.

An operator rotation is one transaction:

# Demonstrates the cost of one proxy rotation (lab node)
acct = w3.eth.account.from_key("<LAB_PRIVATE_KEY>")
tx = contract.functions.setProxy("http://new-lab-proxy.local/path").build_transaction({
    "from": acct.address,
    "nonce": w3.eth.get_transaction_count(acct.address),
    "gas": 100000,
    "gasPrice": w3.to_wei("30", "gwei"),
})
signed = w3.eth.account.sign_transaction(tx, acct.key)
tx_hash = w3.eth.send_raw_transaction(signed.raw_transaction)
print(f"Proxy updated: {tx_hash.hex()}")

That is the entire cost of defeating a proxy takedown: one signed transaction and a fraction of a cent.

The encryptor under the hood

The blockchain angle gets the headlines, but the payload itself is a well-built piece of engineering that deserves attention.

DeadLock’s encryptor is written in Rust. That is a deliberate choice with real detection consequences. Rust binaries carry heavy static linking, aggressive inlining, and a runtime that looks nothing like the C/C++ malware most signature sets were trained on. The result is a cross-platform payload that slips past a lot of legacy signature matching, and it forces analysts back onto behavioral detection.

The cryptography is a clean hybrid scheme. Per Microsoft’s analysis, DeadLock pairs Curve25519 elliptic-curve key exchange with the XChaCha20 stream cipher, using the NaCl crypto_box construction (XSalsa20-Poly1305) to wrap each file’s symmetric key. The per-file sequence:

1. Generate an ephemeral Curve25519 keypair for the file.
2. Derive an ECDH shared secret against the operator’s public key.
3. Encrypt the file content with XChaCha20 using a 32-byte random key and a 24-byte nonce.
4. Encrypt the metadata footer with crypto_box using the ECDH shared secret and a zero nonce. The zero nonce is safe here precisely because the ECDH secret is unique per file, so nonce reuse across files never happens.
5. Append the footer to the end of the file.

The footer holds the XChaCha20 key, the 24-byte nonce, random padding, a 4-byte dDlK magic marker, an optional 2-byte FA flag, and chunk parameters. The dDlK magic is a fast format-level sanity check the decryptor uses to confirm a file is theirs before it wastes cycles. The FA flag toggles between sequential and intermittent read strategies during decryption, which mirrors an intermittent-encryption speed optimization on the encrypt side.

One detail worth calling out because it is genuinely odd: the operator public key in the config is 33 bytes, 03bf50bbf97c4e951e66ff12b689a37a3ce675b4921e254eae76da77573843e4a9. That leading 03 is a SEC1 compressed-point prefix borrowed from Bitcoin’s secp256k1 world, and it has no business being on a Curve25519 key. The malware validates the prefix against a lookup table accepting 00, 02, 03, 04, 05, each mapping to an expected length, then strips it and uses only the remaining 32 bytes for the actual Curve25519 scalar multiplication. It reads like a developer who reused a Bitcoin key-parsing routine and never removed the vestigial prefix logic. Small tells like that are gold for attribution and tooling-reuse analysis.

Operationally the encryptor is polite in the way modern ransomware tends to be. It caps itself at roughly 29 percent of system memory and 70 percent of CPU so the machine stays usable while encryption runs, which keeps the victim from noticing and cutting power mid-job. It uses selective encryption, skipping certain directories, extensions, and filenames, and encrypts non-system directories with individual XChaCha20 keys. Encrypted files get the .dlock extension, a custom .ico gets written to disk to change file icons, and the wallpaper is replaced with “Your infrastructure DeadLocked” pointing the victim at the ransom note.

The pre-encryption tradecraft is standard but effective. In a Cisco Talos-investigated intrusion, the actor exploited CVE-2024-51324 in Baidu Antivirus, a bring-your-own-vulnerable-driver primitive used to terminate arbitrary processes, and used it to kill EDR before encrypting. A day before detonation they installed AnyDesk, which was already present in the target environment, to blend persistent access into legitimate tooling.

Why domain seizure and hosting takedowns are structurally ineffective

Strip away the crypto jargon and the reason this beats takedowns comes down to three properties of a deployed contract.

It is distributed. The contract state is replicated across every Polygon node globally. There is no single machine, no data center, no hosting provider you can serve a warrant to.

It is immutable. Once deployed, the contract code cannot be deleted. You cannot revoke it, censor it, or take it offline. The best any authority could do is try to get RPC providers to blocklist a contract address, and a malware author will just point at a different public RPC endpoint or run their own.

It is publicly readable. Anyone, including a piece of malware with zero credentials, can read the current state. That is the same property that lets you audit a DeFi contract; it also lets an encryptor fetch its proxy for free.

Contrast that with a Tor hidden service. Onion services still resolve through introduction points and rendezvous circuits, still run on a server the operator controls, and law enforcement has repeatedly demonstrated it can deanonymize, seize, and impersonate them. The plug exists. DeadLock removed the plug for the one component that used to be the reliable choke point.

The honest caveat, and the place defenders should push, is the residual surface. The proxy the URL points to is still a real host that can be blocked or seized, though the operator just rotates to a new one for a cent. The Wasabi exfil archives can be removed, which strips the extortion leverage but does not recover a single encrypted file or destroy a key. Session identities are ephemeral. So the resilient core is untouchable, but the extremities are not. That is where the defensive fight actually lives now.

Detection surface: what defenders can still see

You cannot take down the contract. You can absolutely see a machine on your network talking to it. The detection strategy has to move from “seize the infrastructure” to “catch the retrieval and the behavior.”

The loudest signal is a non-browser, non-developer process making outbound connections to public Polygon RPC endpoints. In a normal enterprise, your accounting workstation has no reason to resolve polygon-rpc.com. Sysmon Event ID 3 catches the connection, Event ID 22 or the DNS-Client ETW provider catches the resolution.

The client that generates that traffic is trivial to model. This Python client mirrors what DeadLock’s HTML JavaScript does, and running it against a lab node shows you exactly what the network telemetry looks like:

# pip install web3
from web3 import Web3

w3 = Web3(Web3.HTTPProvider("http://127.0.0.1:8545"))  # lab node
CONTRACT_ADDRESS = "0x<YOUR_LAB_CONTRACT_ADDRESS>"
ABI = [{"inputs": [], "name": "getProxy",
        "outputs": [{"type": "string"}],
        "stateMutability": "view", "type": "function"}]

contract = w3.eth.contract(address=CONTRACT_ADDRESS, abi=ABI)
proxy_url = contract.functions.getProxy().call()  # eth_call under the hood
print(f"[LAB] Retrieved proxy: {proxy_url}")

Turn that observation into a rule. This Sigma detection fires on the exact behavior, tuned to exclude documented Web3 development:

title: Suspicious Process Querying Polygon RPC Endpoint
status: experimental
description: >
  Detects non-browser, non-developer processes connecting to public Polygon
  RPC providers, consistent with DeadLock-style blockchain C2 retrieval.
logsource:
  product: windows
  category: network_connection   # Sysmon Event ID 3
detection:
  selection:
    DestinationHostname|contains:
      - 'polygon-rpc.com'
      - 'polygon.drpc.org'
      - 'polygon-bor-rpc.publicnode.com'
      - 'rpc-mainnet.matic.network'
  filter_legit:
    Image|contains:
      - '\node.exe'          # only if org has documented Web3 dev use
      - '\MetaMask'
  condition: selection and not filter_legit
fields:
  - Image
  - CommandLine
  - DestinationIp
  - DestinationHostname
  - ProcessId
  - User
level: high
tags:
  - attack.command_and_control
  - attack.t1102.001
  - attack.t1071.001

Elastic already ships a rule for this class, “Potential EtherHiding C2 via Blockchain Connection,” which flags script interpreters and suspicious processes connecting to blockchain API endpoints. Elastic’s own guidance is to review process.name and process.executable to identify which application is making the request and judge whether Web3 functionality is expected on that host. That last judgment is the whole thing: on an endpoint where crypto tooling has no business existing, a blockchain RPC call is a near-perfect indicator.

Then there is the on-chain side, which is a genuine advantage. Every proxy rotation is a permanent, timestamped, publicly readable transaction. Once you have a malicious contract address, Polygonscan lets you enumerate every setProxy write, every caller address, and every historical proxy value the operators ever used. Threat-intel platforms like TRM Labs and Chainalysis Reactor can associate contract and wallet addresses with ransomware operators and alert when your IP space queries them. The immutability that protects the attacker also creates a forensic ledger the attacker can never scrub.

The MITRE mapping ties the behavioral picture together:

The future of RaaS infrastructure resilience

This is not a one-off. ReliaQuest’s assessment is that blockchain-based C2 will spread meaningfully before the end of 2026, and the ecosystem already backs that up. Aeternum is effectively a reusable toolkit for putting bot commands on Polygon. EtherRAT does it on Ethereum. Cry0 moved extortion negotiations onto the Internet Computer. The pattern is a technique commoditizing in real time, and DeadLock proved the ransomware business case.

What does this do to the takedown model? It does not kill it, but it retargets it. Law enforcement can still go after the humans, the initial-access brokers, the money laundering, the exfil hosting, and the proxy layer. What it can no longer do is press one button and orphan every infected machine at once, which was the highest-leverage move in the entire disruption playbook. The strategic response has to shift toward on-chain attribution, RPC-provider cooperation, and cutting off the fiat off-ramps, because the config layer itself is now permanent.

The policy lever people reach for, pressuring RPC providers to blocklist contract addresses, is weak. There are dozens of public Polygon endpoints and anyone can run their own node. Blocklisting is whack-a-mole against something that costs a dollar to relocate.

Defensive recommendations and hardening

Because you cannot delete the contract, you win at the endpoint and the network edge.

• Block outbound traffic to public blockchain RPC providers from any server or non-developer endpoint that has no business reaching them. ReliaQuest specifically flagged polygon-rpc.com, polygon.drpc.org, and polygon-bor-rpc.publicnode.com. Treat blockchain RPC as an unusual destination and default-deny it.
• Deploy the Sigma and Elastic rules above and tune filter_legit to your actual Web3 footprint. On most enterprise fleets that footprint is zero, which makes this detection cheap and high-fidelity.
• Turn on the Microsoft-recommended stack: cloud-delivered AV, EDR in block mode, tamper protection, automated remediation, Controlled Folder Access, and attack-surface-reduction rules. Restrict lateral movement over PsExec and WMI.
• Enable audit driver load and hunt for CVE-2024-51324’s Baidu AV driver to catch the BYOVD stage before EDR gets killed.
• Keep immutable, offline backups. The blockchain resilience changes nothing about recovery. Curve25519 plus XChaCha20 with unique per-file keys means there is no free decryptor coming, and clean restores are still your only guaranteed path back.
• Integrate on-chain threat intelligence. Feed known malicious contract addresses from TRM Labs or Chainalysis into your alerting so a query to a flagged contract lights up immediately.

Key takeaways

• DeadLock moved the single most seizable part of ransomware infrastructure, the C2 proxy pointer, into an immutable Polygon smart contract, which structurally defeats the domain-and-server takedown model that broke LockBit, Hive, and ALPHV.
• The economics are brutally asymmetric: the victim read path via eth_call is free and walletless, an operator rotation costs a fraction of a cent, and standing up the whole thing costs about a dollar, against multi-agency, multi-million-dollar takedown operations.
• The encryptor is serious engineering: Rust, Curve25519 plus XChaCha20 with per-file ephemeral keys and a NaCl crypto_box footer, so expect no free decryptor and plan on backups.
• You cannot take down the contract, but you can absolutely detect the behavior: a non-browser process hitting a Polygon RPC endpoint is a near-perfect indicator on most enterprise fleets.
• Immutability cuts both ways. Every proxy rotation is a permanent, timestamped on-chain record, which turns the blockchain into a forensic ledger the operators can never erase.
• This technique is commoditizing (Aeternum, EtherRAT, Cry0), so build blockchain RPC egress controls and on-chain threat intel into your program now, before it becomes the default RaaS backbone.

Related Tutorials

• Building a Red Team Lab: Infrastructure, VMs, and C2 Setup

References

• references
• www.elastic.co
• DeadLock ransomware: Breaking down a Rust-based encryptor with decentralized recovery infrastructure | Microsoft Security Blog
• DeadLock ransomware uses blockchain to resist infrastructure takedown | BleepingComputer
• The Gentlemen Affiliate Deploys EtherRAT Across Windows Networks Using Ethereum Smart Contract C2 | Hunt.io Blog
• Malware-On-The-Blockchain (On-Chain C2, EtherHiding, ClickFix) | Israel National Digital Agency Cyber Research
• Hide Infrastructure, Technique T1665 – Enterprise | MITRE ATT&CK