[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fp4S2CDWPsh3QNxpXVGe5QA6pryb3CiM7bYZAFZ2mLLA":3},{"article":4,"iocs":50,"watch_terms":56,"solutions":57,"lesson":153},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"53f6e9a3-3a95-49b7-8d12-59e72119594b","DeadLock Ransomware Uses Polygon Smart Contracts to Make Extortion Infra Harder to Disrupt","deadlock-ransomware-uses-polygon-smart-contracts-to-make-extortion-infra-harder--5eca0a","The ransomware group known as DeadLock has been observed using decentralized infrastructure to facilitate victim communications and data leak operations in a bid to improve operational resilience. \"Its recovery ecosystem combines the Session messaging network with blockchain-backed services that store and deliver resources used throughout the extortion process,\" the Microsoft Threat","The DeadLock ransomware group is employing decentralized infrastructure, including Polygon smart contracts and the Session messaging network, to enhance the resilience of its extortion operations. This tactic makes their communication and data leak infrastructure harder to disrupt. The ransomware, first detected in July 2025, uses double extortion and has claimed 96 victims across Italy, Spain, Poland, Türkiye, and the U.S., encrypting files with the '.dlock' extension and demanding payment via Bitcoin or Monero.","DeadLock ransomware leverages Polygon smart contracts and Session messaging for resilient extortion infrastructure.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F08\u002Fdeadlock-ransomware-uses-polygon-smart.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEiHe7Kt8X_4eEC2ICocbCp-eg1Vs7xknMUYEnZzepw5j6mg7v7C7DmPvzf4S-Z4wGhofTJco3eW95xPm3x7nDEzdfF9dpJAEriyIAGsXqNcLT02br6Em30kPnD5vYp4CrHHAR8TvvNr6glr8mIeRwhPANZqTSG7w_tR1-8QUNgYWg4AXgVPrmob7CFzwLmA\u002Fs1600\u002Fdeadlock.jpg","2026-08-11T16:35:27+00:00","2026-08-11T18:00:24.524264+00:00",8,[17,20,23,26,28,30],{"name":18,"type":19},"DeadLock","threat_actor",{"name":21,"type":22},"Session","product",{"name":24,"type":25},"Polygon smart contracts","technology",{"name":27,"type":22},"AnyDesk",{"name":29,"type":22},"Lynx",{"name":31,"type":22},"INC","7d8b5ab8-ea0b-4ced-ae97-ec251b86993a",{"id":32,"icon":34,"name":35,"slug":36},null,"Ransomware","ransomware",[38,40,45],{"category":39},{"id":32,"icon":34,"name":35,"slug":36},{"category":41},{"id":42,"icon":34,"name":43,"slug":44},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[51,53,55],{"type":44,"value":18,"context":52},"Ransomware name",{"type":44,"value":29,"context":54},"Ransomware associated with DeadLock affiliate",{"type":44,"value":31,"context":54},[21,27,29],{"controls":58,"vendors":146},[59,88,117],{"slug":60,"name":61,"problem":62,"products":63},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[64,72,80],{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"slug":89,"name":90,"problem":91,"products":92},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",[93,101,109],{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","zero-trust-endpoint-firewall","Zero Trust Endpoint Firewall","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fzero-trust-endpoint-firewall","Centrally managed host firewall with device-level and dynamic access rules, to limit which machines can talk to each other.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"illumio","Illumio","\u002Fvendor-logos\u002Fillumio.png","illumio-segmentation","Illumio Segmentation","https:\u002F\u002Fwww.illumio.com\u002Fillumio-segmentation","Maps traffic between workloads and enforces segmentation across data centre, cloud and endpoints.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png","guardicore-segmentation","Akamai Guardicore Segmentation","https:\u002F\u002Fwww.akamai.com\u002Fproducts\u002Fakamai-guardicore-segmentation","Software-based microsegmentation with traffic visibility.",{"slug":118,"name":119,"problem":120,"products":121},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",[122,130,138],{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"veeam","Veeam","\u002Fvendor-logos\u002Fveeam.png","veeam-data-platform","Veeam Data Platform","https:\u002F\u002Fwww.veeam.com\u002Fproducts\u002Fveeam-data-platform.html","Backup and recovery for virtual, physical, cloud and SaaS workloads, with immutable storage options.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"commvault","Commvault","\u002Fvendor-logos\u002Fcommvault.png","commvault-cloud","Commvault Cloud","https:\u002F\u002Fwww.commvault.com\u002Fplatform","Backup and recovery platform with immutable storage and recovery testing.",{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":142,"product_name":143,"url":144,"description":145},"cohesity","Cohesity","\u002Fvendor-logos\u002Fcohesity.png","dataprotect","Cohesity DataProtect","https:\u002F\u002Fwww.cohesity.com\u002Fplatform\u002Fdataprotect\u002F","Backup and recovery with immutable snapshots, on premises or as a service.",[147],{"slug":148,"name":149,"logo_path":150,"roles":151},"google","Google","\u002Fvendor-logos\u002Fgoogle.png",[152],"reported_by",{"slug":154,"title":155,"body":156,"framework_refs":157,"framework_notes":169},"deadlock-ransomware-leverages-blockchain-to-evade-takedown-efforts","DeadLock Ransomware Leverages Blockchain to Evade Takedown Efforts","The DeadLock ransomware group has weaponized decentralized Web3 infrastructure — specifically Polygon smart contracts and the Session messaging network — to make their extortion and data-leak channels resistant to traditional law enforcement takedowns. Unlike conventional ransomware C2 servers that can be seized or sinkholed, blockchain-based infrastructure has no central authority to shut down, dramatically increasing the resilience of criminal operations. The group's double extortion model means victims face both encryption of critical data and the threat of public exposure, amplifying pressure to pay. With 96 confirmed victims across five countries in under a year, the rapid spread underscores that organizational defenses must assume compromise will occur and focus equally on recovery and response capabilities. This shift in attacker infrastructure signals a new paradigm where disruption-based countermeasures alone are insufficient.",[158,159,160,161,162,163,164,165,166,167,168],"CIS Control 11 – Data Recovery","CIS Control 13 – Network Monitoring and Defense","CIS Control 17 – Incident Response Management","NIST CSF RS.RP-1 – Response Planning","NIST CSF RC.RP-1 – Recovery Planning","NIST SP 800-184 – Guide for Cybersecurity Event Recovery","NIST IR-4 – Incident Handling","NIST CP-9 – Information System Backup","ITIL Service Continuity Management","GDPR Article 32 – Security of Processing","GDPR Article 33 – Notification of Personal Data Breach",{}]