A Leak Site With No Server To Seize
DeadLock is a Rust-based ransomware operation that Microsoft's own security researchers first observed in July 2025 and detailed in a technical blog published on August 10, 2026. Like most modern ransomware crews, DeadLock runs a double-extortion play: it encrypts a victim's systems and threatens to publish stolen data unless it is paid. Microsoft has also observed the tooling deployed by multiple groups, including an affiliate connected to the Lynx and INC ransomware ecosystems, meaning DeadLock's infrastructure is already being reused rather than run by a single closed crew.
What sets DeadLock apart is where its leak site and negotiation infrastructure actually live. Instead of a rented server behind a hosting provider, DeadLock uses two smart contracts on the Polygon blockchain: one stores the current address of its chat proxy, the other stores the posts on its leak blog. A visitor's browser reads both by issuing free, read-only requests to public Polygon nodes, no cryptocurrency wallet required, and the operators rotate through six separate public endpoints so no single node operator can cut off access.
Why A Blockchain Outlasts A Hosting Provider
A conventional ransomware leak site is a single point of failure by design: it sits on one server, reachable through one hosting account or one Tor entry point, and a hosting provider, registrar, or law enforcement action can take it offline in an afternoon. DeadLock's Polygon-based version has no equivalent weak point. The 'site' is a set of transactions recorded on a public ledger that is copied and verified by thousands of independent validator nodes around the world, and removing it would mean rewriting blockchain history that other, unrelated participants also depend on, which is not realistic.
Microsoft's own assessment of the design is direct: the architecture, in the company's words, likely increases the resilience of DeadLock's communication, leak-hosting, and negotiation infrastructure, letting the operators recover from disruption attempts while keeping continuity for victims. That is a notable admission from the vendor best placed to judge it, and it is the clearest evidence yet that ransomware infrastructure is deliberately moving toward forms that takedown operations cannot easily reach.
Session Messaging Removes The Last Weak Link
Even a blockchain-hosted leak site still needs a way for the operator to talk to the victim, and this is where DeadLock closes its second gap. Victim-operator communication runs over Session, a decentralized, onion-routed messenger built on a swarm network rather than a central server, which gives both sides anonymity without either relying on a company that can be compelled to hand over logs or shut down accounts. DeadLock even derives each victim's Session identity deterministically from their own sign-in credentials, so no separate registration step, and no separate record, is needed.
This matters because chat infrastructure has historically been one of the few places law enforcement could act. Telegram channels and Tor-hosted chat servers used by other ransomware groups have central operators or central hosting that can be pressured, seized, or blocked. Session has neither. Combined with the Polygon leak site, DeadLock has effectively removed both of the centralized touchpoints that past takedown operations against ransomware groups have relied on.
Rust Encryption And A Fast-Growing Victim List
The encryptor itself is competently built, not just the infrastructure around it. DeadLock is written in Rust and uses a hybrid design that pairs Curve25519 elliptic-curve cryptography with the XChaCha20 stream cipher, generating a unique ephemeral key pair for every single file it touches. Encrypted files carry a .dlock extension. None of this is exotic on its own, but paired with decentralized delivery and negotiation infrastructure, it removes the usual soft targets, a seizable server or a breakable chat channel, that responders have leaned on in past cases.
The victim list is growing quickly. Microsoft counted more than 80 organizations published on DeadLock's leak site as of July 2026, more than half of them in Europe, spanning information technology, mining, transportation and logistics, manufacturing, hospitality, and consumer goods, among other sectors, across Europe, Asia, North America, South America, and Africa. A separate technical review by the outlet The Hacker News put the count higher, near 96, with the heaviest concentrations in Italy, Spain, Poland, Turkey, and the United States, a difference likely explained by timing and counting method rather than a contradiction.
What Changes For Manufacturing Owners' Incident Response
Manufacturing sits directly inside DeadLock's named victim sectors, and it is not an incidental one for European owners. Manufacturing subsectors, including makers of machinery, electronics, and motor vehicle components, are classified as important entities under the EU's NIS2 directive, which means incident reporting obligations and a baseline expectation of cyber risk management already apply before an attack ever happens. A DeadLock-style incident is exactly the scenario NIS2's manufacturing scope was written for.
The practical shift is in how much weight an incident-response plan should put on negotiation leverage versus backup readiness. Plans built around 'we can get the leak site taken down' or 'law enforcement can disrupt their communications' assumed a seizable server and a blockable chat channel, and DeadLock has neither. That does not make negotiation useless, but it does mean the fallback, clean, tested, offline backups and a rehearsed recovery process, needs to carry more of the weight than it used to, because the interruption option responders have historically counted on is no longer reliably available against this operator.
Read next: CVSS 9.6 Flaw Hit Load Balancers 792 Times | Autonomous AI Agents Attacked Taiwan's Government
