[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fX6jGmuebZbGRlXSjtNDlfdthaEuyxQUQXzf9GHmLVK8":3},{"article":4,"iocs":55,"watch_terms":58,"solutions":59,"lesson":151},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"8762847b-5488-4af0-866d-3bfc6fd93fdb","DeadLock ransomware uses blockchain to resist infrastructure takedown","deadlock-ransomware-uses-blockchain-to-resist-infrastructure-takedown-009148","The DeadLock ransomware operation is using a decentralized infrastructure that relies on blockchain-backed services to protect its communication with victims and data-leak activity. [...]","The DeadLock ransomware operation has adopted a novel approach by leveraging blockchain technology, specifically the Polygon network, to store configuration data and leak site posts. This decentralized infrastructure, combined with the Session network for encrypted communications, makes it more resilient to takedown attempts by law enforcement. The ransomware employs double-extortion tactics and targets organizations across various sectors, primarily in Europe.","DeadLock ransomware uses blockchain for C2 and leak site, resisting takedowns.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fdeadlock-ransomware-uses-blockchain-to-resist-infrastructure-takedown\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F04\u002F28\u002Fransomware.jpg","2026-08-11T22:15:22+00:00","2026-08-12T00:00:12.04154+00:00",8,[17,20,23,25,27,29],{"name":18,"type":19},"DeadLock","product",{"name":21,"type":22},"blockchain","technology",{"name":24,"type":22},"Polygon",{"name":26,"type":22},"Session",{"name":28,"type":19},"Wasabi",{"name":30,"type":31},"Microsoft","vendor","7d8b5ab8-ea0b-4ced-ae97-ec251b86993a",{"id":32,"icon":34,"name":35,"slug":36},null,"Ransomware","ransomware",[38,43,45,50],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":44},{"id":32,"icon":34,"name":35,"slug":36},{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56],{"type":49,"value":18,"context":57},"Ransomware name",[30,18,28],{"controls":60,"vendors":147},[61,89,118],{"slug":62,"name":63,"problem":64,"products":65},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[66,74,82],{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":83,"vendor_name":30,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"slug":90,"name":91,"problem":92,"products":93},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[94,102,110],{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",{"slug":119,"name":120,"problem":121,"products":122},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",[123,131,139],{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"cohesity","Cohesity","\u002Fvendor-logos\u002Fcohesity.png","dataprotect","Cohesity DataProtect","https:\u002F\u002Fwww.cohesity.com\u002Fplatform\u002Fdataprotect\u002F","Backup and recovery with immutable snapshots, on premises or as a service.",{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"veeam","Veeam","\u002Fvendor-logos\u002Fveeam.png","veeam-data-platform","Veeam Data Platform","https:\u002F\u002Fwww.veeam.com\u002Fproducts\u002Fveeam-data-platform.html","Backup and recovery for virtual, physical, cloud and SaaS workloads, with immutable storage options.",{"vendor_slug":140,"vendor_name":141,"vendor_logo":142,"product_slug":143,"product_name":144,"url":145,"description":146},"commvault","Commvault","\u002Fvendor-logos\u002Fcommvault.png","commvault-cloud","Commvault Cloud","https:\u002F\u002Fwww.commvault.com\u002Fplatform","Backup and recovery platform with immutable storage and recovery testing.",[148],{"slug":83,"name":30,"logo_path":84,"roles":149},[150],"reported_by",{"slug":152,"title":153,"body":154,"framework_refs":155,"framework_notes":169},"deadlock-ransomware-uses-blockchain-to-evade-takedowns","DeadLock Ransomware Uses Blockchain to Evade Takedowns","The DeadLock ransomware group has innovated its infrastructure by storing configuration data and leak site content on the Polygon blockchain, making traditional law enforcement takedown tactics largely ineffective. By combining decentralized blockchain storage with the encrypted Session messaging network, the group has engineered a resilient command-and-control architecture that cannot simply be seized or disabled. This double-extortion operation — encrypting data while threatening to publish it — compounds victim pressure significantly. The shift to decentralized infrastructure signals a broader trend where criminal groups adapt faster than law enforcement response frameworks, making organizational self-defense the primary line of protection. Organizations, particularly those in European sectors targeted by this group, must assume that attacker infrastructure will persist and focus on internal resilience rather than expecting takedowns to neutralize the threat.",[156,157,158,159,160,161,162,163,164,165,166,167,168],"CIS Control 11 – Data Recovery","CIS Control 13 – Network Monitoring and Defense","CIS Control 17 – Incident Response Management","NIST SP 800-61r2 – Computer Security Incident Handling Guide","NIST SP 800-184 – Guide for Cybersecurity Event Recovery","NIST CSF RS.RP-1 – Response Planning","NIST CSF RC.RP-1 – Recovery Planning","NIST AC-17 – Remote Access Controls","GDPR Article 32 – Security of Processing","GDPR Article 33 – Notification of Personal Data Breach","MITRE ATT&CK T1486 – Data Encrypted for Impact","MITRE ATT&CK T1567 – Exfiltration Over Web Service","ITIL Service Continuity Management",{}]