Microsoft Threat Intelligence published its analysis of DeadLock on 10 August 2026, following earlier work by Singapore-based Group-IB in January. The ransomware itself is conventional: Rust, double extortion, first seen July 2025, 96 claimed victims as of August 2026 across Italy, Spain, Poland, Türkiye and the US.

The infrastructure is not conventional, and that is the story.

Two wallets doing the job of two servers

DeadLock stores operational data in two Polygon wallet addresses:

  • One holds proxy server URLs for routing communications
  • The other hosts the data leak blog posts

Microsoft's assessment:

This architecture likely increases resilience of portions of its communication, leak-hosting, and negotiation infrastructure, allowing DeadLock operators to recover from some disruption efforts.

Note the hedging — "portions of", "some disruption efforts". Microsoft is not claiming this is untouchable, and neither should anyone else.

But consider what a takedown normally consists of. Law enforcement identifies the hosting provider, serves process, seizes the server, and puts a splash page on the domain. Every step of that assumes a server and a provider.

A wallet address on a public chain has neither. The data is replicated across every node, readable by anyone, and there is no operator to serve.

Negotiation moved too

Ransom notes direct victims to Session, a privacy-focused messenger, as the primary contact channel. An HTML recovery file provides an alternative interface with end-to-end encrypted chat, a paginated data leak blog, and a file browser — none of which requires a traditional backend.

That last detail is the one to sit with. The victim-facing "portal" that ransomware crews normally host is now a file, running locally, reading from the chain.

What this actually changes, and what it does not

Changed: the leak site and the proxy list are durable. The blog cannot be seized. The proxy list regenerates with infinite variants, so blocking known proxies is a treadmill.

Not changed: the encryption, the intrusion, the initial access. DeadLock still has to get in, and it gets in the same way everyone else does. Nothing about Polygon helps with that.

Also not changed: the money. Payments still move through channels that can be traced and, occasionally, frozen. Publishing your leak blog on a public ledger is resilient and it is also, permanently, public — every post timestamped and attributable to an address.

The timeline has a gap worth noting. Group-IB observed the first public victim discoveries in late May 2026, and the group has been active since July 2025. Roughly ten months of attacks preceded the first victims becoming visible. A leak site is a marketing channel; its absence does not mean the attacks were not happening.

What defenders should take from it

  • Do not plan around takedowns. They were never a control you owned, and for this group they are less likely than usual.
  • The intrusion is still the place to spend. The July ransomware wave came in through unpatched edge devices and phishing, and so does this.
  • Watch for Session as an IoC. A Session client appearing on a corporate endpoint is worth a question.
  • Expect the victim count to be understated. Ten months of activity before public victims appeared means the leak blog is a partial record by design.

The strategic read: ransomware operators have spent five years hardening against disruption, and this is what the current step looks like. It is incremental — the crews still need initial access, still need to encrypt, still need to get paid. What they no longer need is a hosting provider willing to look away.