DeadLock is a low-profile, Windows-focused ransomware operation active since July 2025. It stands out for using Polygon blockchain smart contracts to host its command-and-control proxy addresses, an unusual and takedown-resistant approach to infrastructure.

Unlike most modern ransomware brands, DeadLock runs no public data leak site (DLS) and has no known tie to an established affiliate program. That choice, combined with a small number of confirmed victims, has kept it largely out of mainstream threat reporting.

Origin, Targeting, and Reach

DeadLock was first observed in July 2025 and has kept a deliberately quiet operational footprint since. Its extortion model departs from classic double extortion: instead of threatening to publish stolen data on a leak site, operators threaten to sell it on underground markets if the ransom goes unpaid. Whether those sales actually happen is unclear, and the threat may serve mainly as psychological pressure. 

Targeting is opportunistic and global. Documented activity spans 37 countries across every inhabited continent: 

• Americas: Argentina, Brazil, Canada, Colombia, Mexico, United States, Uruguay 

• Europe: Bulgaria, Croatia, Czech Republic, Denmark, Finland, Germany, Greece, Hungary, Italy, Lithuania, Netherlands, Norway, Poland, Spain, Sweden, Switzerland, Turkey, United Kingdom 

• Africa: Angola, Gabon, Kenya, Mayotte (listed as “YT” in the source), South Africa 

• Asia-Pacific: Australia, India, Indonesia, Papua New Guinea, Philippines, Singapore, Taiwan 

Across 20 documented industries, the spread is equally broad: Agriculture & Livestock, Automotive, BFSI, Chemicals, Construction, Education, Energy & Utilities, Government & Law Enforcement, Healthcare, Hospitality, IT & ITES, Manufacturing, Metals, Minerals & Mining, Organization, Pharmaceuticals & Biotechnology, Professional Services, Real Estate, Technology, Telecommunications, and Transportation & Logistics. 

No per-country or per-industry victim counts have been published. Without a leak site, victim visibility is especially limited, so this list reflects observed targeting rather than volume. 

Malware Arsenal

DeadLock pairs a custom encryptor with commodity remote-access tooling and a vulnerable signed driver. Three families are associated with the group, plus the driver used for defense evasion. 

Tool	Type	Role in intrusions
DeadLock	Ransomware	Windows encryptor using a custom stream cipher and process injection; disables security tools, deletes backups, renames files to .dlock
AnyDesk	Remote access software (abused as backdoor)	Legitimate remote desktop tool repurposed for hands-on access and likely lateral movement
Remote CMD/PowerShell terminal	Reconnaissance, backdoor	VMProtect-packed implant giving operators remote CMD and PowerShell execution over encrypted HTTP
Baidu Antivirus driver (CVE-2024-51324)	Vulnerable signed kernel driver (BYOVD)	Loaded to kill EDR and antivirus processes from kernel mode

DeadLock Ransomware 

The payload is built to cripple recovery while leaving the host usable, so the victim can still read the note and pay. It shuts down security software, removes backup capabilities, swaps file icons, and changes the desktop wallpaper to point at the ransom instructions. Payment is accepted in Bitcoin and Monero. 

AnyDesk 

No custom implant is needed here. AnyDesk exclusions in the group’s service-termination scripts suggest operators rely on it for interactive access, a common pattern among groups that lean on remote monitoring and management (RMM) tools. 

Remote CMD/PowerShell Terminal 

This backdoor is packed with VMProtect and encrypts its strings and settings to resist analysis. It first sends basic host details to its C2, then waits for commands. Traffic runs over HTTP, protected with 3DES and Base64 encoding, and command output returns the same way. In practice, it supports lateral movement, privilege escalation, data theft, and staging of further payloads. 

Attack Chain 

The initial access vector is not confirmed, but artifacts point to a hands-on intrusion built on stolen credentials and living-off-the-land tools, ending in encryption and private negotiation. 

1. Access with valid accounts. Operators log in with compromised legitimate credentials, which also serve them for persistence and movement later. 

2. Remote access set up. Registry changes enable RDP, and services such as RemoteRegistry are started to allow remote configuration. AnyDesk and the Remote CMD/PowerShell terminal give interactive control. 

3. Reconnaissance. Operators run mmc.exe with compmgmt.msc to inspect and manage the system without needing a full RDP session. 

4. Defenses disabled. A loader drops the vulnerable Baidu Antivirus driver, loads it in kernel mode, and sends an IOCTL that kills EDR and antivirus processes. Windows Defender real-time and cloud protection are switched off via SystemSettingsAdminFlows.exe. 

5. Pre-encryption script. A PowerShell script checks its privileges, relaunches itself elevated with an execution policy override to sidestep UAC, then stops non-critical services, sparing remote-access tools such as AnyDesk. 

6. Recovery removed. Backups and recovery features are disabled so victims cannot restore without paying. 

7. Encryption. The DeadLock payload encrypts files, appends .dlock, changes file icons, and replaces the wallpaper to point at the HTML ransom note. 

8. Negotiation over Session. The note’s embedded client fetches a proxy address from a Polygon smart contract, then relays the victim into the decentralized Session messenger to negotiate. 

Spotlight: Polygon Smart Contracts as C2 Infrastructure 

DeadLock’s most distinctive trait is storing its proxy addresses on the Polygon blockchain instead of hard-coding them. The malware and the ransom note’s chat client both read the current proxy URL from a smart contract, then use that proxy to relay traffic. 

This design has three practical effects for defenders: 

• Rotation without redeployment. Operators update the address in the contract, and every sample picks up the new proxy. Seizing or blocking one proxy does not break the operation. 

• No on-chain footprint. The lookups are read-only calls. They create no transactions and cost no fees, so there is nothing to trace on the public ledger. 

• Hard to block. The queries go to legitimate blockchain RPC endpoints, which conventional firewall rules and threat feeds rarely flag. 

The same mechanism bootstraps negotiation. The HTML ransom note embeds a browser-run client that pulls the proxy from the contract, then routes the victim into the Session encrypted messaging network. The result is layered obfuscation: a decentralized address book feeding a decentralized messenger. 

The technique fits a wider emerging trend of attackers using smart contracts for evasion and resilience. DeadLock’s use is notable less for complexity than for showing how cheaply criminal infrastructure can be moved beyond the reach of traditional takedowns. 

Tactics, Techniques, and Procedures (TTPs) 

Initial access relies on compromised valid accounts rather than a documented exploit or phishing lure. The same credentials support persistence, privilege escalation, and evasion, since activity under a legitimate account blends in with normal administration. 

Execution leans on native Windows tooling. PowerShell scripts enumerate and stop services before encryption, and service execution (for example, starting RemoteRegistry) enables remote configuration. Registry edits turn on RDP, and mmc.exe with compmgmt.msc gives administrative reach without an interactive session. 

Defense evasion is the group’s most developed area: 

• BYOVD: the signed but vulnerable Baidu Antivirus driver (CVE-2024-51324) terminates EDR and antivirus processes from kernel mode. 

• Native utilities: SystemSettingsAdminFlows.exe is used to disable Windows Defender real-time and cloud protection. 

• UAC bypass: the pre-encryption script relaunches itself with admin rights and an execution policy override. 

• Obfuscation: the PowerShell backdoor is VMProtect-packed with encrypted strings, and the ransomware uses process injection. 

Command and control runs through proxies whose addresses live in a Polygon smart contract, with the Remote CMD/PowerShell terminal using 3DES-encrypted HTTP. Victim negotiation moves to the Session messenger. 

Impact comes from the DeadLock encryptor, which uses a custom stream cipher, removes backups and recovery options, and appends .dlock to files. Public detail on initial access, lateral movement, and the data exfiltration channel remains limited, even though later ransom notes explicitly claim data theft. 

Conclusion 

DeadLock is a small but technically deliberate ransomware operation whose danger lies in evasion rather than scale. It combines stolen credentials, native Windows tools, a kernel-level EDR killer, and blockchain-hosted proxies into a chain that avoids most signature- and blocklist-based defenses. 

Its tradecraft is still evolving. Early samples only encrypted files, while later ransom notes claim data theft and offer extras such as post-payment security reports and “incident closure” guarantees. This suggests operators are refining their pressure tactics, possibly in response to how victims negotiate. 

With activity across 37 countries and 20 industries, DeadLock should be treated as a credible, adaptive threat. Its use of Polygon smart contracts deserves tracking as an early indicator of how ransomware infrastructure may shift toward decentralized, takedown-resistant services. 

Tracking that shift takes more than watching your own network. DeadLock posts no victims, rotates its infrastructure on-chain, and sells stolen data quietly, so its early signals surface on underground markets long before encryption. Cyble threat intelligence platform brings those signals into view, giving security teams the context to act while a threat like DeadLock is still emerging, not after the ransom note appears. 

Mitigations and Recommendations 

• Enforce phishing-resistant MFA on all remote access, VPN, and administrative accounts, and monitor for logins from unusual locations or at unusual times, since valid accounts are the entry point. 

• Enable Microsoft’s vulnerable driver blocklist and Hypervisor-protected Code Integrity (HVCI), and alert on loading of the Baidu Antivirus driver tied to CVE-2024-51324 or any new kernel driver on servers and workstations. 

• Turn on EDR tamper protection and alert when security agents or Defender protections stop unexpectedly, including changes made via SystemSettingsAdminFlows.exe. 

• Inventory approved remote-access tools and block or alert on unapproved AnyDesk installs and sessions. 

• Alert on registry changes that enable RDP, on unexpected starts of the RemoteRegistry service, and on mmc.exe launching compmgmt.msc from unusual accounts. 

• Enable PowerShell script-block, module, and transcription logging, and flag scripts that relaunch with elevated rights or use execution policy overrides. 

• Watch for mass service termination and for deletion of shadow copies or backups, which typically precede encryption. 

• Inspect and, where business allows, restrict outbound connections to blockchain RPC endpoints (such as Polygon nodes) from hosts with no reason to reach them. 

MITRE ATT&CK Mapping 

• Initial Access (TA0001) – Valid Accounts (T1078): Adversaries obtain and abuse the credentials of existing accounts to gain an initial foothold in victim environments. 

• Execution (TA0002) – PowerShell (T1059.001): Uses PowerShell commands and scripts to execute code, enumerate the system, and stop services. 

• Execution (TA0002) – Service Execution (T1569.002): Abuses the Windows Service Control Manager to start services and execute commands or payloads. 

• Persistence (TA0003) – Valid Accounts (T1078): Uses compromised credentials to maintain access across sessions without deploying additional implants. 

• Privilege Escalation (TA0004) – Valid Accounts (T1078): Abuses credentials of privileged accounts to obtain higher levels of access on systems. 

• Privilege Escalation (TA0004) – Bypass User Account Control (T1548.002): Circumvents UAC mechanisms to run processes with elevated privileges without prompting the user. 

• Defense Evasion (TA0005) – Valid Accounts (T1078): Operates under legitimate accounts so that malicious activity blends in with normal administrative behavior. 

• Defense Evasion (TA0005) – Modify Registry (T1112): Alters Windows registry settings to change system configuration, enable remote access, or hide activity. 

• Defense Evasion (TA0005) – Exploitation for Defense Evasion (T1211): Exploits software or driver vulnerabilities to bypass or disable security controls. 

• Defense Evasion (TA0005) – MMC (T1218.014): Abuses the Microsoft Management Console, a trusted signed binary, to proxy execution and perform administrative actions. 

• Defense Evasion (TA0005) – Bypass User Account Control (T1548.002): Evades UAC prompts so that elevated processes can run and tamper with security settings undetected. 

• Defense Evasion (TA0005) – Disable or Modify Tools (T1562.001): Disables or modifies security tools such as antivirus and EDR to avoid detection of tools and activity.

Frequently Asked Questions 

What is DeadLock? 

DeadLock is a Windows ransomware family active since July 2025. It runs no public leak site, has no known affiliate-program ties, and has a small number of confirmed victims. 

Why is DeadLock notable? 

It stores its C2 proxy addresses in Polygon blockchain smart contracts. This lets operators rotate infrastructure at will through read-only lookups that leave no on-chain trace and are hard to block. 

How does DeadLock extort victims without a leak site? 

Operators threaten to sell stolen data on underground markets rather than publish it. Whether they follow through is unclear. 

How do victims contact the attackers? 

Through an HTML ransom note with an embedded browser client. It fetches a proxy from the smart contract and connects the victim to the Session encrypted messenger. 

How does DeadLock disable security tools? 

Mainly through BYOVD: it loads a signed but vulnerable Baidu Antivirus driver (CVE-2024-51324) to kill EDR and antivirus processes. It also turns off Windows Defender protections with built-in utilities. 

How does DeadLock gain initial access? 

The exact vector is unconfirmed. Available evidence points to compromised valid accounts, followed by remote access through RDP, AnyDesk, and a PowerShell backdoor. 

What are the signs of a DeadLock infection? 

Files renamed with the .dlock extension, changed file icons, a replaced desktop wallpaper, and an HTML ransom note. Payment is demanded in Bitcoin or Monero. 

Which countries and industries does it target? 

Documented activity spans 37 countries and 20 industries, from healthcare and government to mining and telecommunications. No ranked victim counts have been published. 

Disclaimer: This profile was compiled from open-source security reporting and the provided source material. It is provided for reference only, and readers are responsible for how they rely on it. Validate any indicators against internal telemetry before operational use.