Group-IB printed its report on Jan. 15 and stated the strategy might make disruption more durable for defenders.
The malware reads on-chain knowledge, so victims don’t pay gasoline charges.
Researchers stated Polygon is just not susceptible, however the tactic might unfold.
Ransomware teams often depend on command-and-control servers to handle communications after breaking right into a system.
However safety researchers now say a low-profile pressure is utilizing blockchain infrastructure in a means that may very well be more durable to dam.
In a report printed on Jan. 15, cybersecurity agency Group-IB stated a ransomware operation often called DeadLock is abusing Polygon (POL) sensible contracts to retailer and rotate proxy server addresses.
These proxy servers are used to relay communication between attackers and victims after programs are contaminated.
As a result of the data sits on-chain and will be up to date anytime, researchers warned that this strategy might make the group’s backend extra resilient and more durable to disrupt.
Good contracts used to retailer proxy data
Group-IB stated DeadLock doesn’t rely on the standard setup of mounted command-and-control servers.
As a substitute, as soon as a machine is compromised and encrypted, the ransomware queries a particular sensible contract deployed on the Polygon community.
That contract shops the most recent proxy tackle that DeadLock makes use of to speak. The proxy acts as a center layer, serving to attackers preserve contact with out exposing their important infrastructure instantly.
For the reason that sensible contract knowledge is publicly readable, the malware can retrieve the main points with out sending any blockchain transactions.
This additionally means victims don’t must pay gasoline charges or work together with wallets.
DeadLock solely reads the data, treating the blockchain as a persistent supply of configuration knowledge.
Rotating infrastructure with out malware updates
One cause this technique stands out is how rapidly attackers can change their communication routes.
Group-IB stated the actors behind DeadLock can replace the proxy tackle saved contained in the contract at any time when mandatory.
That provides them the flexibility to rotate infrastructure with out modifying the ransomware itself or pushing new variations into the wild.
In conventional ransomware instances, defenders can generally block visitors by figuring out identified command-and-control servers.
However with an on-chain proxy checklist, any proxy that will get flagged will be changed just by updating the contract’s saved worth.
As soon as contact is established by the up to date proxy, victims obtain ransom calls for together with threats that stolen data can be bought if cost is just not made.
Why takedowns change into tougher
Group-IB warned that utilizing blockchain knowledge this manner makes disruption considerably more durable.
There isn’t any single central server that may be seized, eliminated, or shut down.
Even when a particular proxy tackle is blocked, the attackers can change to a different one with out having to redeploy the malware.
For the reason that sensible contract stays accessible by Polygon’s distributed nodes worldwide, the configuration knowledge can live on even when the infrastructure on the attackers’ facet adjustments.
Researchers stated this provides ransomware operators a extra resilient command-and-control mechanism in contrast with typical internet hosting setups.
A small marketing campaign with an creative technique
DeadLock was first noticed in July 2025 and has stayed comparatively low profile up to now.
Group-IB stated the operation has solely a restricted variety of confirmed victims.
The report additionally famous that DeadLock is just not linked to identified ransomware affiliate programmes and doesn’t seem to function a public knowledge leak web site.
Whereas which will clarify why the group has obtained much less consideration than main ransomware manufacturers, researchers stated its technical strategy deserves shut monitoring.
Group-IB warned that even when DeadLock stays small, its method may very well be copied by extra established cybercriminal teams.
No Polygon vulnerability concerned
The researchers harassed that DeadLock is just not exploiting any vulnerability in Polygon itself.
It’s also not attacking third-party sensible contracts similar to decentralised finance protocols, wallets, or bridges.
As a substitute, the attackers are abusing the general public and immutable nature of blockchain knowledge to cover configuration data.
Group-IB in contrast the method to earlier “EtherHiding” approaches, the place criminals used blockchain networks to distribute malicious configuration knowledge.
A number of sensible contracts linked to the marketing campaign had been deployed or up to date between August and Nov. 2025, in accordance with the agency’s evaluation.
Researchers stated the exercise stays restricted for now, however the idea may very well be reused in many alternative types by different menace actors.
Whereas Polygon customers and builders usually are not dealing with direct danger from this particular marketing campaign, Group-IB stated the case is one other reminder that public blockchains will be misused to assist off-chain legal exercise in methods which can be troublesome to detect and dismantle.
