Full Report
This blog uncovers DeadLock’s stealthy usage of Polygon smart contracts for proxy address storage, a poorly-documented and under-reported technique that Group-IB analysts have observed increased usage in the wild. Variants of this technique are very wide and offer great alternatives to threat actors for bypassing traditional defenses by abusing decentralized blockchains available worldwide.
Analysis Summary
# Tool/Technique: DeadLock Ransomware & Blockchain-Based C2 Retrieval
## Overview
DeadLock is a ransomware family that employs a stealthy and sophisticated method for Command and Control (C2) communication. Its primary innovation is the abuse of the **Polygon blockchain** smart contracts to store and retrieve proxy C2 addresses. By utilizing decentralized infrastructure, the malware bypasses traditional IP/domain-based reputation filtering and ensures the persistence of its backend infrastructure against takedowns.
## Technical Details
- **Type:** Malware Family (Ransomware) / Technique (Blockchain C2)
- **Platform:** Windows
- **Capabilities:** Data encryption, backup destruction, service termination, and decentralized C2 address retrieval.
- **First Seen:** Reported significantly in wild usage in 2024.
## MITRE ATT&CK Mapping
- **TA0002 - Execution**
- T1059.003 - Windows Command Shell: Executes CMD files for environmental preparation.
- T1059.001 - PowerShell: Uses scripts to stop services and cleanup.
- **TA0005 - Defense Evasion**
- T1070.004 - File Deletion: Self-deleting PowerShell scripts post-execution.
- **TA0011 - Command and Control**
- T1219.002 - Remote Desktop Software: Abuse of AnyDesk for RMM.
- T1102.003 - Web Service: One-Way Communication (Blockchain Proxy Retrieval).
- **TA0040 - Impact**
- T1486 - Data Encrypted for Impact: Primary ransomware function.
- T1489 - Service Stop: Disables non-native services.
- T1490 - Inhibit System Recovery: Destroys Volume Shadow Copies and backups.
## Functionality
### Core Capabilities
- **Decentralized C2 Discovery:** Queries specific smart contracts on the Polygon network to obtain the actual IP addresses or domains of its C2 infrastructure.
- **Service Management:** Stops all non-native Windows services to ensure files are not locked by other applications during encryption, notably sparing AnyDesk to maintain actor access.
- **Inhibit Recovery:** Deletes shadow copies and backup files to prevent victims from restoring data without paying.
### Advanced Features
- **Smart Contract Proxy Storage:** Uses the immutable and public nature of the blockchain to store C2 data, making it difficult for defenders to "null-route" the infrastructure without blocking legitimate blockchain RPC nodes.
- **Self-Cleaning:** Utilizes PowerShell commands that delete the script file immediately after the execution phase is complete to reduce the forensic footprint.
## Indicators of Compromise
### File Hashes (SHA256)
- `3cd5703d285ed2753434f14f8da933010ecfdc1e5009d0e438188aaf85501612`
- `c9cc95ff8f2998229394dfd31c2bd6b723e826a3ca5e008d2b5be19ba419ae2c`
- `3c1b9df801b9abbb3684670822f367b5b8cda566b749f457821b6481606995b3`
- `be1037fac396cf54fb9e25c48e5b0039b3911bb8426cbf52c9433ba06c0685ce`
### Network Indicators (Defanged)
- **C2 URLs:**
- hxxp[://]138.226.236.51/prrq[.]php
- hxxp[://]94.74.164.207/prrq[.]php
- hxxps[://]biggoalsports[.]co.za/minif[.]php
- hxxps[://]nmsneustadtl[.]ac.at/xml[.]php
- hxxps[://]envisionreg[.]com/wp-activate[.]php
- **IP Addresses:**
- 138[.]226.236[.]51
- 94[.]74.164[.]207
## Associated Threat Actors
- **DeadLock Group:** An emerging ransomware collective focusing on double extortion.
## Detection Methods
- **Behavioral Detection:** Monitor for mass service termination (specifically excluding AnyDesk) followed by high-volume file I/O (encryption). Watch for processes (like `cmd.exe` or `powershell.exe`) making unexpected connections to blockchain RPC endpoints (e.g., Polygon-related APIs).
- **Network Monitoring:** Flag DNS queries or HTTPS traffic directed at decentralized infrastructure nodes (e.g., `polygon-rpc.com`) from unauthorized internal processes.
## Mitigation Strategies
- **Blockchain Gateway Filtering:** Restrict access to public blockchain RPC nodes unless required for legitimate business functions.
- **Endpoint Hardening:** Implement Restricted PowerShell execution policies and monitor for the deletion of Volume Shadow Copies (`vssadmin delete shadows`).
- **Access Control:** Enforce strict Application Control policies to prevent the execution of unauthorized RMM tools like AnyDesk.
## Related Tools/Techniques
- **Unchained/Blockchain DNS:** Similar techniques used by malware like NJRat or Glupteba to hide C2s.
- **AnyDesk Abuse:** Commonly seen in other ransomware operations like LockBit or Conti for maintaining persistence.