The DeadLock ransomware uses Polygon smart contracts to dynamically distribute and rotate proxy server addresses, helping it evade security mechanisms. First detected in July 2025, it embeds JavaScript within HTML to interact with the Polygon network and acquire attacker-controlled server addresses via RPC lists. The latest variant includes encrypted communication via the Session app, enhancing direct communication with victims.