DeadLock: Ransomware Gang Uses Smart Contracts to Mask Its Work

Summary

DeadLock ransomware has adopted Polygon smart contracts as a resilient way to publish and rotate proxy URLs used for command-and-control (C2), allowing the backend infrastructure to change quickly without relying on conventional domains. Following encryption, the actors drop an HTML “payment/communication” wrapper that steers victims to the decentralized messenger Session for further instructions and interaction. The technique resembles the EtherHiding pattern previously reported in North Korean-linked activity, using blockchain data as an indirection layer for malicious infrastructure. Notably, DeadLock appears to deprioritize traditional public leak sites and instead monetizes stolen data through underground marketplace sales.

Investigation

Group-IB analysts documented DeadLock’s smart-contract–backed approach to concealing C2 endpoints, including the post-encryption drop of an HTML file that explicitly references Session as the communication channel. The report also cites earlier Cisco Talos reporting that associated DeadLock activity with BYOVD (bring-your-own-vulnerable-driver) techniques and EDR process termination, though precise initial-access vectors were not conclusively identified. Similar “smart contract as C2 directory” tradecraft has also been discussed by Google Threat Intelligence Group in the context of North Korean campaigns, reinforcing the broader trend of leveraging public blockchains for infrastructure agility.

Mitigation

Monitor endpoints for unexpected HTML artifacts that launch or reference Session (or other decentralized messengers) after suspicious file activity. Enforce strong application allowlisting and restrict execution of unapproved tools that can facilitate remote access, payload staging, or messenger installation. On the network side, review egress for connections to proxy URLs or domains that appear to be derived from blockchain-stored pointers and treat sudden shifts in outbound destinations as a high-signal anomaly. Continuously update endpoint detections to identify BYOVD driver loading, suspicious driver installs, and behaviors consistent with EDR tampering or forced security-service termination.

Response

If DeadLock indicators are identified, isolate impacted systems immediately to prevent further encryption and lateral movement. Collect and preserve the dropped HTML wrapper, encryption notes, and any related binaries or scripts, then block outbound traffic to any observed proxy URLs and smart-contract-referenced infrastructure. Initiate formal incident response procedures, validate the integrity and availability of offline/backed-up recovery paths before remediation, and assess potential data exposure to determine extortion risk. Where appropriate, coordinate stakeholder communications and engage specialized ransomware response support while performing full scoping and eradication.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands:

  The threat actor, having compromised a smart‑contract‑controlled proxy service, rotates the proxy URL every few minutes to evade static blocklists. Each rotation publishes a new sub‑domain under deadlock.example.com. The ransomware queries the proxy to retrieve the next C2 address. To emulate this, we issue a series of HTTP requests to three distinct URLs that all contain the literal string “.example.com”, mimicking the rotation pattern observed in the wild.

• Regression Test Script:

  #!/usr/bin/env bash
  # DeadLock Proxy URL Rotation Simulation – generates telemetry that matches the Sigma rule
  
  PROXY="http://proxy.example.local:3128"
  URLs=(
    "http://stage1.example.com/deadlock"
    "http://stage2.example.com/deadlock"
    "http://stage3.example.com/deadlock"
  )
  
  echo "[*] Starting proxy‑URL rotation simulation (3 requests)..."
  for url in "${URLs[@]}"; do
    echo "[+] Requesting $url via $PROXY"
    curl -s -x "$PROXY" "$url" -o /dev/null
    sleep 2   # short pause to emulate realistic interval
  done
  
  echo "[*] Simulation complete."

• Cleanup Commands:

  #!/usr/bin/env bash
  # Remove any temporary files created during the simulation (none in this case)
  echo "[*] No artifacts to clean up. Leaving proxy configuration untouched."