Deadlock: The ransomware that exploits Polygon to evade detection

Researchers at Group-IB have identified a new cybercrime threat that demonstrates the increasing sophistication of modern malware. The ransomware family known as Deadlock was discovered in Q2 2025 and exhibits alarming evasion capabilities. Notably, Deadlock not only targets conventional systems but also employs a novel strategy: it leverages the decentralized infrastructure of Polygon to distribute its malicious components and rotate proxy server addresses in a manner almost impossible to intercept.

How Deadlock Uses Blockchain to Hide

Deadlock’s technical mechanism is particularly clever. The malware injects JavaScript code into HTML files that interact directly with the Polygon network. Once executed, it uses lists of RPC nodes as gateways to obtain updated addresses of servers controlled by the attackers. This tactic exploits the distributed and pseudo-anonymous nature of blockchain to build covert communication channels that are extremely difficult to block using traditional security techniques.

The Evolution of Sophisticated Evasion Techniques

This concealment strategy is not entirely new. Researchers have previously documented similar methods in the EtherHiding malware, which also used decentralized architectures to evade detection. However, Deadlock represents a qualitative advance in its application. Analyses reveal that at least three variants of Deadlock are currently circulating in the wild, and the latest version has escalated its sophistication by directly integrating the encrypted messaging application Session.

Security Implications

This integration of Session into the latest Deadlock variant significantly expands the malware’s operational capabilities. Attackers can now communicate encrypted directly with victims, facilitating ransom negotiations and instruction distribution without detectable exposure. The combination of Polygon as the distribution infrastructure and Session as the communication channel creates a multipurpose attack architecture that challenges traditional incident response mechanisms.