DeadLock ransomware now uses Polygon smart contracts to hide server addresses and evade detection.

According to ChainCatcher, the ransomware family DeadLock is employing Polygon smart contracts to distribute and rotate proxy server addresses, aiming to evade security detection. Initially discovered in July 2025, this malware embeds JavaScript code within HTML files to interact with the Polygon network, using RPC lists as gateways to obtain server addresses controlled by attackers. This technique resembles the previously identified EtherHiding method, which leverages decentralized ledgers to create hard-to-block covert communication channels. DeadLock has released at least three variants, with the latest version incorporating the encrypted communication application Session to directly communicate with victims.