DeadLock Ransomware Uses Polygon Smart Contracts to Make Extortion Infra Harder to Disrupt

The DeadLock ransomware group has been using decentralized infrastructure to manage communications with victims and leak stolen data, aiming to make its operations more resilient. This infrastructure utilizes a combination of the Session messaging network and blockchain-based services to store and deliver resources used during the extortion process. The use of such decentralized systems makes it harder to disrupt the group's extortion infrastructure. The approach is part of the group's recovery ecosystem, which has been observed by Microsoft Threat Intelligence. This method allows DeadLock to maintain its operations with increased difficulty for disruption. The blockchain-backed services are specifically used to facilitate the extortion process.