Beware of DeadLock Ransomware: How to Use Polygon Smart Contracts to Avoid Disruption

【ChainNews】The cybersecurity research team recently exposed a cunning threat—DeadLock ransomware is abusing Polygon smart contracts to evade tracking. This malware has been active since last summer. What is its core method? It dynamically calls on-chain smart contracts to update command and control server addresses, making it impossible to lock down the victim’s communication channels.

The infection process is straightforward: after data is encrypted, DeadLock issues a ransom note threatening victims—pay up or have the stolen information publicly sold. This tactic may seem old-fashioned, but the issue lies in the way the infrastructure is hidden. Traditional C2 servers for ransomware can be shut down, but DeadLock writes proxy addresses into the blockchain, with global nodes permanently storing this information, making centralized intervention nearly impossible.

This method of relaying proxy addresses through on-chain smart contracts is highly variable, making it difficult for defenders to respond. Although the current known victims of DeadLock are few and its exposure limited, it demonstrates a new approach—using decentralized infrastructure to enhance the resilience of malicious activities. For organizations with weak security awareness, this has already become a tangible threat.