DeadLock ransomware made headlines for moving its command-and-control infrastructure onto the Polygon blockchain — a technique that makes law enforcement takedowns nearly impossible. Microsoft Threat Intelligence published a detailed technical breakdown on August 10, 2026, describing the group’s Rust-based encryptor, its mathematically sound per-file ephemeral key design, and the decentralized ecosystem it built around smart contracts, Session messaging, and Wasabi cloud storage. The report describes DeadLock as having “no practical recovery path” without paying the ransom.
More than 80 organizations across four continents have been hit. Security firm ReliaQuest flagged DeadLock as Q2 2026’s most technically significant emerging ransomware group and assessed that additional groups will likely adopt blockchain-based C2 before year’s end.
The technical sophistication is real. The cryptography is sound. But the attack still depends on something mundane: writing files to a Windows file system.
The Attack Chain Depends on File System Operations
Before DeadLock can encrypt anything, it has to land on the target system. That means writing an executable payload to disk — via email attachment, drive-by download, compromised remote desktop session, or lateral movement from an already-compromised machine.
Once the payload executes, DeadLock’s pre-encryption routine terminates Windows Defender, Volume Shadow Copy services, and any EDR processes it recognizes. It enumerates running services and kills those on its stop list. It targets cloud sync clients like OneDrive, Dropbox, and Google Drive to eliminate cloud-based recovery options.
Then it starts encrypting. For each file, DeadLock generates a fresh 32-byte random key and encrypts the file contents using XChaCha20. It uses per-file ephemeral Curve25519 keypairs and elliptic-curve Diffie-Hellman to wrap the encryption key. Every file gets its own unique shared secret — eliminating key reuse and making mathematical recovery impossible without the attacker’s private key.
The encryptor applies tiered encryption based on file size: full encryption for files under 50 MB, intermittent 512-byte chunks for larger files. A database or VM image with 10% of its content encrypted in scattered blocks is operationally unusable — but takes a fraction of the time to encrypt, which matters for evading behavioral detection.
A resource-aware throttling mechanism monitors system memory and CPU utilization. If memory use exceeds 29% or CPU load exceeds 70%, encryption pauses until resources drop below those thresholds. The machine continues functioning visibly normally — suppressing the performance spike that might alert a user or trigger a behavioral detection rule.
All of that sophistication requires one thing: writing modified files back to the Windows file system.
FileSure Blocks the Attack at the File System Layer
FileSure Defend operates at the Windows kernel level via a filter driver that intercepts file operations before they complete. It doesn’t try to recognize ransomware. It controls which programs are allowed to perform which file operations — and blocks everything else.
The most upstream intervention happens during payload delivery. When DeadLock’s executable arrives via email attachment, browser download, or SMB write from a compromised remote machine, FileSure intercepts the write operation. If the delivery mechanism — Outlook, Chrome, or a remote access session — is not authorized to write executable files to that location, the write is denied. The payload never lands on disk. It never executes. The EDR termination routine never runs. The encryption never starts.
Here’s a FileSure rule configuration that blocks executable payload delivery:
File name filter: *.exe;*.dll;*.bat;*.cmd;*.ps1
Program name filter: outlook.exe;chrome.exe;firefox.exe;REMOTE ACCESS
Operations: Write, Create
Drive type: Hard drives
Result: Block
Email clients and browsers cannot write executable files to the hard drive. Remote machines cannot write executable files through SMB shares. The malware payload is blocked at the delivery stage — before it ever runs.
If a payload somehow bypasses that control and begins encrypting files, FileSure’s threshold rule detects the bulk modification pattern and blocks further damage:
File name filter: * (all files)
Operations: Write, Rename / Move
Drive type: Hard drives, Network drives, Removable drives
Threshold: 20 matches within 60 minutes
Result: Block subsequent operations after threshold
Normal user behavior — opening and saving documents — stays well below 20 file modifications per hour. Ransomware encryption events modify hundreds of files per minute. The threshold fires within seconds. Subsequent write and rename operations are blocked. Damage is contained to the files modified before the threshold triggered.
DeadLock’s operators built censorship-resistant infrastructure. They used mathematically sound cryptography. They accounted for EDR, behavioral detection, and resource monitoring. They didn’t account for a kernel filter driver that simply denies unauthorized file write operations.
Blockchain C2 is clever. Per-file ephemeral keys eliminate mathematical recovery paths. But if the executable never lands on your file system, the rest of the attack chain never happens.
You can see FileSure working in your environment in about five minutes. Install it, open a Word document, and check the console — the file operation is already recorded. Then download our test file that mimics ransomware behavior and watch FileSure block it in real time.
Start your free 21-day trial at bystorm.com — 1 server, 10 workstations, fully functional, no credit card required.
Source: DeadLock Ransomware Hides C2 on Polygon Blockchain, 80-Plus Victims Hit
Category: Ransomware
Tags: deadlock ransomware, blockchain c2, polygon, file system security, kernel filter driver, ransomware prevention, xchacha20 encryption
