business π» DeadLock ransomware uses blockchain to stay alive
The DeadLock ransomware is utilizing a decentralized infrastructure powered by blockchain to evade infrastructure takedowns. This threat actor emerged in mid-2025, employing double-extortion tactics against victims. By July this year, its data leak site listed 80 organizations, primarily from Europe across various sectors. The group uses Polygon blockchain to store configuration data, making C2 addresses hard to track. Victims are pressured to pay in Bitcoin or Monero for decryption keys and data deletion promises. π