Microsoft Threat Intelligence published a technical analysis of DeadLock ransomware, an emerging operation utilizing decentralized infrastructure including Polygon blockchain and Session network.

Key Details

• First observed in July 2025 using double extortion tactics.
• Uses Polygon smart contracts for proxy configuration and data leak blog storage.
• Routes encrypted victim communication through the Session decentralized messenger network.
• Implements resource-aware throttling (29% RAM, 70% CPU thresholds) and hybrid Curve25519/XChaCha20 encryption.

In This Story