DeadLock Ransomware, Dynamic Deployment of Proxy Server Address via Polygon Smart Contract

PumpDetector · 2026-01-26T04:26:55+00:00

The DeadLock ransomware utilizes innovative techniques to evade security systems by dynamically changing proxy server addresses, exploiting smart contracts on the Polygon network. This advancement complicates detection, presenting ongoing challenges for cybersecurity teams.

PumpDetector

2026-01-26 04:26:55

Abstract generation in progress

Security threats are becoming increasingly sophisticated. According to recent monitoring results from Group-IB, the ransomware family DeadLock has developed innovative evasion techniques. This malware exploits smart contracts on the Polygon network to continuously change proxy server addresses, thereby bypassing security detection systems.

The Emergence of Advanced Evasion Techniques

First discovered in mid-2025, DeadLock employs a different approach from traditional malware. Attackers inject JavaScript code into HTML files that interacts with the Polygon network. This code uses RPC (Remote Procedure Call) lists as gateways, automatically obtaining and updating server addresses that control the attack infrastructure. This technique exploits the immutability and decentralized nature of blockchain, making it extremely difficult for conventional centralized detection systems to block.

Analysis of Attack Mechanism via Proxy Servers

The core of this technique lies in the dynamic management of proxy server addresses. DeadLock reads information stored in blockchain smart contracts to periodically change the route to new proxy servers. Similar to previously discovered malware like EtherHiding, DeadLock has built a more automated and scalable infrastructure. Frequent changes of proxy servers invalidate security team blocklists in real-time, while maintaining communication channels between attackers and victims.

Constantly Evolving Ransomware Threats

At least three variants have been identified so far, with the latest versions being even more threatening. Attackers have embedded encrypted communication sessions directly into the ransomware, enabling direct negotiations with victims. This demonstrates that ransomware operators are advancing not only evasion techniques but also post-attack monetization methods. DeadLock’s proxy server management techniques are likely to be imitated by other malware families in the future, posing new challenges for cyber defense teams.

View Original

This page may contain third-party content, which is provided for information purposes only (not representations/warranties) and should not be considered as an endorsement of its views by Gate, nor as financial or professional advice. See Disclaimer for details.