{"id":134,"date":"2026-01-16T11:59:14","date_gmt":"2026-01-16T11:59:14","guid":{"rendered":"https:\/\/1stblock.info\/?p=134"},"modified":"2026-01-16T11:59:14","modified_gmt":"2026-01-16T11:59:14","slug":"deadlock-ransomware-leverages-polygon-smart-contracts-for-stealthy-persistence","status":"publish","type":"post","link":"https:\/\/1stblock.info\/?p=134","title":{"rendered":"DeadLock Ransomware Leverages Polygon Smart Contracts for Stealthy Persistence"},"content":{"rendered":"\n

Cybersecurity analysts at Group-IB<\/strong> have uncovered a new ransomware strain named DeadLock<\/strong> that utilizes the Polygon blockchain to maintain its communication infrastructure. By weaponizing smart contracts, the malware is able to rotate proxy addresses, effectively shielding itself from traditional law enforcement takedowns.<\/p>\n\n\n\n

Innovative Evasion Tactics<\/strong><\/h3>\n\n\n\n

Initially detected in July 2024, DeadLock has maintained a relatively “low profile.” It currently lacks a public data-leak site and has targeted a limited number of victims. However, Group-IB warns that its technical sophistication should not be underestimated.<\/p>\n\n\n\n

The ransomware’s core innovation lies in its use of Polygon smart contracts<\/strong> to store and update the addresses of its command-and-control (C2) servers. When a system is infected, the malware interacts with a specific contract on the blockchain. It uses a built-in function to retrieve the most current proxy server address, allowing the attackers to switch their infrastructure dynamically if a specific server is blocked or seized.<\/p>\n\n\n\n

The “Immutable” Infrastructure<\/strong><\/h3>\n\n\n\n

The primary advantage for the cybercriminals is the decentralized nature of the blockchain. Because the proxy directory is stored on-chain:<\/p>\n\n\n\n

    \n
  • No Central Point of Failure:<\/strong> There is no central hosting provider that authorities can shut down to kill the malware’s “phone book.”<\/li>\n\n\n\n
  • Permanent Data:<\/strong> The malicious instructions persist across thousands of global nodes indefinitely.<\/li>\n\n\n\n
  • Infinite Scalability:<\/strong> Researchers noted that this technique allows for nearly infinite variations, limited only by the attacker\u2019s imagination.<\/li>\n<\/ul>\n\n\n\n

    Tracing the Roots: From EtherHiding to DeadLock<\/strong><\/h3>\n\n\n\n

    The concept of using blockchain for malware is an evolving trend. Group-IB pointed to a similar tactic known as “EtherHiding,”<\/strong> which was identified by Google in late 2023. That method was attributed to the North Korean state-sponsored group UNC5342<\/strong>, which embedded malicious JavaScript payloads directly into blockchain transactions.<\/p>\n\n\n\n

    DeadLock represents a shift in this evolution, moving from simple payload storage to active, automated infrastructure management through smart contract functions.<\/p>\n","protected":false},"excerpt":{"rendered":"

    Cybersecurity analysts at Group-IB have uncovered a new ransomware strain named DeadLock that utilizes the Polygon blockchain to<\/p>\n","protected":false},"author":2,"featured_media":135,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[4],"tags":[],"class_list":["post-134","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-altcoins"],"brizy_media":[],"_links":{"self":[{"href":"https:\/\/1stblock.info\/index.php?rest_route=\/wp\/v2\/posts\/134","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/1stblock.info\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/1stblock.info\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/1stblock.info\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/1stblock.info\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=134"}],"version-history":[{"count":1,"href":"https:\/\/1stblock.info\/index.php?rest_route=\/wp\/v2\/posts\/134\/revisions"}],"predecessor-version":[{"id":136,"href":"https:\/\/1stblock.info\/index.php?rest_route=\/wp\/v2\/posts\/134\/revisions\/136"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/1stblock.info\/index.php?rest_route=\/wp\/v2\/media\/135"}],"wp:attachment":[{"href":"https:\/\/1stblock.info\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=134"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/1stblock.info\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=134"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/1stblock.info\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=134"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}