# DeadLock Ransomware: Smart Contracts for Malicious Purposes — Blockchain-Automated Ransom Operations

> DeadLock is a ransomware operation active since at least mid-2025 that introduces smart contract integration for ransom payment operations — a novel convergence of blockchain/DeFi technology and ransomware. DeadLock encrypts files with .dlock extension using RSA+AES hybrid encryption (no known decryptor), deploys ransom notes (HOW_RECOVER.[ID].txt) with unique 6-character victim IDs, and communicates via Session messenger (decentralized, end-to-end encrypted). The Group-IB 'Smart Contracts for Malicious Purposes' report documents how DeadLock leverages blockchain smart contracts for automated ransom payment verification, escrow mechanisms, and potentially affiliate payment distribution — eliminating the need for manual payment verification and creating a trustless, auditable ransomware payment infrastructure that operates independently of any single C2 server.

- **Published:** 2026-02-12T05:46:00Z
- **Last reviewed:** 2026-02-12T05:46:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0069
- **ID:** TL-2026-0069
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** DeadLock
- **Detections:** 12 · **IOCs:** 32 (full data via the Threadlinqs MCP server — Purple tier)

## Description

DeadLock ransomware represents a significant evolution in ransomware operations by integrating blockchain smart contracts into the ransom payment pipeline. While ransomware groups have accepted cryptocurrency payments for years, DeadLock goes further by using smart contracts to automate payment verification, escrow, and potentially affiliate revenue distribution — creating a decentralized, trustless ransomware payment infrastructure.

ENCRYPTION AND FILE OPERATIONS:
DeadLock uses hybrid RSA+AES encryption — AES for file content encryption (speed) with RSA for key encryption (security). Encrypted files receive a .[random 6-character hex].dlock extension (e.g., .F8C6A8.dlock). The same 6-character ID serves as the victim's personal identifier throughout the ransom negotiation process. Ransom notes are dropped as HOW_RECOVER.[ID].txt (e.g., HOW_RECOVER.BF6377.txt) and RECOVERY_CHAT.[ID].HTML. The HTML variant opens a browser-based chat interface for negotiation. No known decryption tool exists — the encryption implementation appears cryptographically sound based on victim reports and analysis.

COMMUNICATION INFRASTRUCTURE:
DeadLock uses Session messenger (getsession.org) for victim communication — a decentralized, end-to-end encrypted messaging platform based on the Oxen blockchain. Session IDs serve as contact points (e.g., 05804f9b14b02f44fa97795a60ab1faf5128e3259c75459aaaaeabc80c14da78). Session's decentralized architecture means there is no central server to take down, no IP addresses to trace, and no metadata to collect. This is a deliberate operational security choice — Session provides stronger anonymity guarantees than Tor-based .onion sites used by traditional ransomware groups.

SMART CONTRACT INTEGRATION:
The novel aspect documented by Group-IB: DeadLock integrates blockchain smart contracts into ransomware operations. Smart contracts are self-executing programs deployed on a blockchain that automatically execute when predefined conditions are met. In DeadLock's model:

1. AUTOMATED PAYMENT VERIFICATION: Smart contracts monitor blockchain addresses for incoming payments matching the ransom amount. When payment is confirmed on-chain, the contract automatically triggers the next phase — potentially including decryption key release or affiliate notification. This eliminates manual payment verification delays.

2. ESCROW MECHANISMS: Smart contracts can function as trustless escrow — holding ransom payments until both parties fulfill obligations. In theory, a smart contract could hold payment until the victim confirms decryption works, then release funds to the operator. This creates 'trust' in the ransomware transaction without either party trusting the other.

3. AFFILIATE PAYMENT DISTRIBUTION: For RaaS-model operations, smart contracts can automatically split payments between affiliates, operators, and developers based on predefined percentages. This eliminates the trust problem inherent in criminal partnerships — no single party controls the funds.

4. ON-CHAIN AUDITABILITY: All smart contract transactions are publicly visible on the blockchain. While addresses are pseudonymous, the payment flow is transparent. This creates a verifiable record for both the criminal operation and for investigators.

PAYMENT METHODS:
DeadLock accepts Bitcoin and Monero. Bitcoin payments provide pseudonymous transactions that are publicly traceable on the blockchain — smart contract integration works natively with Bitcoin through Bitcoin Script or through Ethereum/EVM-compatible chains for more complex logic. Monero provides stronger privacy guarantees (ring signatures, stealth addresses) but has limited smart contract capabilities.

RANSOM PROCESS:
The documented ransom process follows a structured negotiation:
1. Victim receives ransom note with personal ID and Session contact
2. Victim contacts operator via Session messenger
3. Victim sends 2-3 encrypted files for test decryption (proof of capability)
4. Operator decrypts test files (max 5MB) as proof
5. Payment negotiated and executed (BTC/XMR)
6. Smart contract verifies payment on-chain
7. Decryptor tool delivered

Post-payment deliverables include: decryption tool, stolen file inventory, proof of data deletion, attack methodology report, security recommendations, and a 'promise' of no future attacks.

DOUBLE EXTORTION:
DeadLock employs standard double extortion: 'We have downloaded all the company's confidential data.' Data exfiltration precedes encryption, creating dual leverage — pay for decryption AND data deletion. The 'confidential data' threat implies a leak site exists or is planned.

IMPLICATIONS OF SMART CONTRACT INTEGRATION:
Smart contract integration fundamentally changes ransomware economics and enforcement:
- CENSORSHIP RESISTANCE: Smart contracts on public blockchains cannot be seized, shut down, or modified by law enforcement. The payment infrastructure operates independently of any server or domain.
- TRUSTLESS OPERATIONS: Removes the trust problem between ransomware operators and affiliates. Payment distribution is automated and immutable.
- AUTOMATED SCALING: Payment verification and distribution happen automatically, enabling higher transaction volumes without operational overhead.
- FORENSIC OPPORTUNITY: Ironically, on-chain transactions are publicly visible. Smart contract code can be analyzed. Payment flows can be traced (especially Bitcoin). This creates a forensic surface that doesn't exist in traditional cash-based criminal operations.
- REGULATORY CHALLENGE: Smart contracts on decentralized blockchains operate outside traditional financial regulation. OFAC sanctions on wallet addresses are the primary enforcement tool, but new addresses can be generated trivially.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1566 Phishing
- T1133 External Remote Services
- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter
- T1204 User Execution
- T1053 Scheduled Task/Job
- T1543 Create or Modify System Process
- T1068 Exploitation for Privilege Escalation
- T1027 Obfuscated Files or Information
- T1685 Disable or Modify Tools
- T1070 Indicator Removal
- T1003 OS Credential Dumping
- T1110 Brute Force
- T1083 File and Directory Discovery
- T1135 Network Share Discovery
- T1082 System Information Discovery
- T1018 Remote System Discovery
- T1021 Remote Services
- T1005 Data from Local System
- T1039 Data from Network Shared Drive
- T1560 Archive Collected Data
- T1071 Application Layer Protocol
- T1573 Encrypted Channel
- T1095 Non-Application Layer Protocol
- T1041 Exfiltration Over C2 Channel
- T1567 Exfiltration Over Web Service
- T1486 Data Encrypted for Impact
- T1490 Inhibit System Recovery
- T1489 Service Stop
- T1657 Financial Theft
- T1583 Acquire Infrastructure
- T1587 Develop Capabilities
- T1588 Obtain Capabilities
- T1585 Establish Accounts
- T1569 System Services
- T1047 Windows Management Instrumentation
- T1547 Boot or Logon Autostart Execution
- T1055 Process Injection
- T1036 Masquerading

## Sources

- [Group-IB: DeadLock Ransomware — Smart Contracts for Malicious Purposes](https://www.group-ib.com/blog/deadlock-ransomware/)
- [BleepingComputer: DeadLock Ransomware Support Thread — Victim Reports and Analysis](https://www.bleepingcomputer.com/forums/t/810441/deadlock-ransomware-random-6-chardlock-same-random-6ransomnotetxt/)
- [Session Messenger — Decentralized E2E Encrypted Platform (DeadLock C2)](https://getsession.org/)
- [MITRE ATT&CK — Data Encrypted for Impact (T1486)](https://attack.mitre.org/techniques/T1486/)
- [No More Ransom Project — Ransomware Decryption Tools](https://www.nomoreransom.org/en/decryption-tools.html)
- [Chainalysis — Ransomware Cryptocurrency Payment Tracking Methodology](https://www.chainalysis.com/blog/ransomware-2024/)
- [OWASP Smart Contract Top 10 — Smart Contract Security Risks](https://owasp.org/www-project-smart-contract-top-10/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0069