# DeadLock Ransomware: Rust-Based Encryptor with Decentralized Recovery Infrastructure on Polygon and Session

> DeadLock is a financially motivated ransomware operation, first observed July 2025, using a Rust-based encryptor (XChaCha20 + Curve25519 ECDH key wrapping via NaCl crypto_box) and double-extortion tactics. It runs decentralized recovery infrastructure spanning nine identical Polygon smart contracts (proxy rotation and blog storage), the Session/Oxen messaging network for victim chat, and Wasabi S3-compatible hosting for leaked data, and has published over 80 victims as of July 2026.

- **Published:** 2026-08-10T00:00:00Z
- **Last reviewed:** 2026-08-10T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1981
- **ID:** TL-2026-1981
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** DeadLock ransomware operators
- **Detections:** 9 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier)

## Description

DeadLock is a Rust-based Windows ransomware encryptor first compiled around June 27, 2025 and observed in active double-extortion operations from July 2025 onward. Each file is encrypted with a per-file ephemeral Curve25519 keypair and a random 32-byte XChaCha20 key/24-byte nonce, wrapped via NaCl crypto_box (XSalsa20-Poly1305) using an operator-controlled recipient key generated through the Windows CryptoAPI; encryption is applied at tiered rates (100%/50%/25%/10%) based on file size, and encrypted files are renamed to <filename>.<UID>.dlock with a cleartext ephemeral public key appended as a footer. Before encrypting, the malware XOR-decrypts an embedded 8-byte configuration blob, checks system language against 18 geofenced language IDs associated with Russia/CIS/Ukraine/Iran-region locales and self-deletes on a match, attempts UAC bypass via randomly named batch scripts invoked with the RunAs verb (up to 10 retries) when not already elevated, and enables six Windows token privileges (SeDebugPrivilege, SeRestorePrivilege, SeBackupPrivilege, SeTakeOwnershipPrivilege, SeAuditPrivilege, SeSecurityPrivilege). It empties the recycle bin on all drives, terminates roughly 40 services and associated processes (Windows Defender, Volume Shadow Copy service, Hyper-V, Active Directory services, backup tools, remote-access utilities) via a configuration-embedded stop list, and separately deploys a PowerShell script that whitelists AnyDesk (the operators' preserved remote-access channel) while stopping 200+ other services and deleting all Volume Shadow Copies. It clears 8 hardcoded Windows Event Log channels via the classic clear-log API and additionally tampers with the registry at HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels, setting Enabled=0 and overwriting ChannelAccess with a restrictive SDDL string, using wevtapi.dll to enumerate and clear both built-in and third-party custom log channels. Directory traversal uses a two-tier exclusion system (pre-traversal skip of user AppData/Program Files/ProgramData, plus during-traversal exclusion of system/boot/config folders), and encryption is performed by 2x-CPU-core worker threads with resource-aware throttling (pausing dispatch above 29% memory or below 30% CPU idle) to preserve system responsiveness during the attack. After encryption, DeadLock generates a custom desktop wallpaper bitmap and registers a custom .dlock file icon via registry, drops a text ransom note (HOW_RECOVER.<UID>.txt) on a second directory pass, deploys an HTML recovery/chat application (RECOVERY_CHAT.<UID>.html) to drive roots and the Desktop, and self-deletes via a batch loop. The RECOVERY_CHAT application is a self-contained, obfuscated-JavaScript browser client implementing a full end-to-end-encrypted chat, a paginated leak-blog viewer, and a file browser without any traditional backend server. Victim identity for chat is derived deterministically (SHA-512 of a generated username/password pair -> Ed25519 keypair -> Curve25519 conversion -> Session-style address with a '05' prefix); messages are encrypted to the recipient's Curve25519 key with NaCl sealed boxes, signed with Ed25519, padded to 160-byte boundaries, and wrapped in an onion-routed protobuf request (PUT /api/v1/message) relayed by a proxy server to Session swarm nodes. Configuration for this recovery layer -- including rotating proxy server addresses and blog content (BBCode posts, image galleries, file attachments) -- is stored and retrieved via free, read-only calls to Polygon blockchain smart contracts rather than conventional DNS infrastructure: a primary/chat-proxy contract (0x8EF7c3e531d871D3B9D559722DE77EB1dEc19dAe, function selector 0x933a9ce8) and a separate blog-storage contract (0x757984507c82c8dA1d3969c535dB5706eEE6426C, function selector 0xd4070542), accessed through six public RPC endpoints for redundancy. Independent blockchain analysis identified nine Polygon contracts sharing identical bytecode (Solidity 0.8.24): eight clones deployed in rapid succession on August 10, 2025 (23:07-23:32 UTC) followed by the main contract on August 11, 2025, with the operator's proxy contract funded with 42 MATIC from a FixedFloat exchange wallet. Seven setProxy calls between August 12-15, 2025 rotated infrastructure, after which the operation went silent for roughly three months before reactivating on November 13, 2025 with a new proxy endpoint. Leaked-data hosting and browsing uses Wasabi (AWS S3-compatible) storage accessed with AWS4-HMAC-SHA256-signed requests and client-side-generated pre-signed download URLs, requiring no backend server. Observed C2/proxy network infrastructure includes an active endpoint at 138.226.236.51 (Ukraine-registered netblock, Frankfurt-hosted, serving /prrq.php) and a prior, now-inactive endpoint at 94.74.164.207 (Iran-registered), alongside Cloudflare-fronted bulletproof hosting at privatenetwork.ltd and several compromised legitimate websites (biggoalsports.co.za, envisionreg.com, nmsneustadtl.ac.at) used as C2 proxies. As of July 2026, the DeadLock leak blog has published claims against more than 80 organizations, with roughly 57% of claimed victims concentrated in the Europe/Russia region and the remainder split across APAC, North America, South America, and the Middle East/Africa; manufacturing organizations make up the largest share of claimed victims, followed by IT, mining, transportation/logistics, hospitality, and consumer goods. Microsoft assesses DeadLock is deployed by multiple, financially motivated affiliate groups, including at least one linked to the Lynx and INC ransomware ecosystems; independent analysis (BinDiff) previously found 48-70.8% function-level code overlap between Lynx and INC samples, indicating Lynx's encryptor was built on purchased/adapted INC source code -- both families also use Curve25519-based key wrapping, aligning with cryptographic choices observed in DeadLock. The combination of blockchain-hosted configuration, onion-routed messaging, and S3-compatible leak-data hosting is intended to make DeadLock's victim-facing recovery/extortion infrastructure resistant to conventional domain seizure and takedown, though it remains dependent on public RPC endpoint availability, proxy uptime, and the underlying storage provider, and its on-chain activity (contract deployments, funding transactions, proxy rotations) is permanently public and auditable, including a traceable link to a FixedFloat exchange wallet.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1584 Compromise Infrastructure
- T1059 Command and Scripting Interpreter
- T1548 Abuse Elevation Control Mechanism
- T1134 Access Token Manipulation
- T1685 Disable or Modify Tools
- T1027 Obfuscated Files or Information
- T1112 Modify Registry
- T1614 System Location Discovery
- T1219 Remote Access Tools
- T1071 Application Layer Protocol
- T1490 Inhibit System Recovery
- T1489 Service Stop
- T1657 Financial Theft

## Sources

- [DeadLock ransomware: Breaking down a Rust-based encryptor with decentralized recovery infrastructure](https://www.microsoft.com/en-us/security/blog/2026/08/10/deadlock-ransomware-breaking-down-a-rust-based-encryptor-with-decentralized-recovery-infrastructure/)
- [DeadLock Ransomware Uses Polygon Smart Contracts For Proxy Rotation](https://www.infosecurity-magazine.com/news/deadlock-polygon-smart-contracts/)
- [DeadLock Ransomware: Smart Contracts for Malicious Purposes](https://www.group-ib.com/blog/deadlock-ransomware-polygon-smart-contracts/)
- [Flash Report: DeadLock's Ransomware Leak Site Lists over 80 Victims](https://www.zerofox.com/intelligence/flash-report-deadlocks-ransomware-leak-site-lists-over-80-victims/)
- [Deadlock Ransomware WebChat: Polygon Beacon And Session Crypto](https://threatscene.com/blog-update/ransomware-over-webchat-deadlock/)
- [Lynx Ransomware: A Rebranding of INC Ransomware](https://unit42.paloaltonetworks.com/inc-ransomware-rebrand-to-lynx/)
- [DeadLock ransomware group exploit Polygon smart contracts for stealth](https://www.cryptopolitan.com/deadlock-ransomware-group-exploit-polygon/)
- [DeadLock Ransomware Uses Polygon Smart Contracts for Command-and-Control](https://socprime.com/active-threats/deadlock-ransomware-analysis/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1981