DeadLock ransomware uses blockchain to resist infrastructure takedown

DeadLock ransomware uses the Polygon blockchain to store configuration data and leak-site posts, querying smart contracts via eth_call to replace chat proxies without modifying victim apps. The operation, active since mid-2025, listed 80 mostly European organizations by July and uses the Session network and Wasabi cloud.