Cybersecurity firm Group-IB has identified a new ransomware named DeadLock that leverages Polygon smart contracts to avoid detection. Unlike traditional ransomware, DeadLock does not rely on hardcoded command and control (C2) servers. Instead, it queries smart contracts on the Polygon network to obtain proxy server addresses, enabling dynamic infrastructure rotation. This method of using blockchain to store configuration data renders conventional domain or IP blocking ineffective. Discovered in July 2025, DeadLock also employs encrypted communication software Session for ransom negotiations, threatening to sell stolen data if the ransom is not paid.