DeadLock

DeadLock is a Windows ransomware family first reported in July 2025. It is notable for using Polygon smart contracts to manage and rotate proxy/C2 infrastructure, an approach described as similar to EtherHiding. Reporting states that DeadLock stores proxy server addresses in Polygon smart contracts and can update them via functions such as setProxy, allowing resilient infrastructure rotation and complicating blocking and analysis. Victim communications are conducted through the Session decentralized messenger; DeadLock drops a custom HTML wrapper that interfaces with Session and, in newer reporting, JavaScript in that wrapper queries Polygon RPC endpoints, retrieves proxy information, and routes encrypted messages through proxy infrastructure. DeadLock has been described as low-profile and without a traditional public data leak site, though reporting indicates its extortion evolved from encryption-only notes in June 2025 to later threats of data theft, exposure, or sale of stolen data on underground markets by August 2025.

Technically, DeadLock has been described as a C++ ransomware targeting Windows systems and using a custom, sophisticated stream-cipher/custom cryptographic implementation with time-based cryptographic keys rather than standard Windows cryptographic APIs. Cisco Talos reported that it selectively targets enterprise file types and uses anti-forensics to avoid system corruption while encrypting files. Observed tradecraft includes use of legitimate administrative tooling alongside custom malware, including PowerShell scripts to stop non-whitelisted services, delete shadow copies, and remove or impair security, backup, and recovery mechanisms. AnyDesk has been explicitly noted as whitelisted and assessed as likely used for remote access; Talos also reported RDP enablement and lateral movement in at least one intrusion.

DeadLock has also been linked to BYOVD-based defense evasion. Multiple sources state it exploited the vulnerable Baidu Antivirus driver BdApiUtil.sys (CVE-2024-51324) to disable or terminate EDR/security processes at kernel level, including Baidu EDR, using a loader/EDR-killer component prior to ransomware deployment. Subsequent activity reportedly included privilege escalation, disabling Windows Defender real-time protection, deleting shadow copies, and executing PowerShell scripts to hinder recovery. In one reported intrusion, infected systems displayed wallpaper stating "Your infrastructure DeadLocked," and ransom notes included a unique Session ID for negotiation.

Associated reporting attributes DeadLock activity to a financially motivated threat actor rather than a state actor, although its blockchain-based infrastructure technique has been compared to methods previously observed in North Korean operations. High-confidence detections and indicators mentioned in reporting include ClamAV names Win.Tool.EDRKiller-10058432-0, Win.Tool.VulnBaiduDriver-10058431-1, Ps.Tool.DeleteShadowCopies-10058429-0, and Win.Ransomware.Deadlock-10058428-0, as well as Snort SIDs 65576, 65575, and 301358.