Microsoft Threat Intelligence has uncovered that the DeadLock ransomware group is leveraging decentralized infrastructure, including Polygon smart contracts and the Session messaging…
DeadLock is a ransomware group first detected in July 2025, known for double extortion tactics and using decentralized infrastructure to enhance operational…
DeadLock ransomware uses hybrid cryptography (Curve25519 and XChaCha20), selective encryption, and geofencing. It employs an HTML-based recovery chat that interacts with Polygon…
Polygon is a blockchain platform that DeadLock uses to deploy smart contracts for proxy server address rotation and hosting data leak blogs.…
Wasabi is a protocol used by DeadLock to host data leak blog content on the Polygon blockchain, enabling browsable access without a…
EtherHiding is a covert technique that embeds malicious code within smart contracts on public blockchains like BNB Smart Chain or Ethereum. It…
Cybersecurity researchers have uncovered a new evolution of the EtherHiding blockchain-based command-and-control (C2) technique, dubbed NullReceiver, which conceals the C2 server IP…
ENS is a blockchain-based name service used by Dysphoria for C2 resolution. The botnet uses ENS domains like m3rnbvs5d[.]eth and burrberry[.]eth to…
SNS is a blockchain-based name service on Solana used by Dysphoria for C2 resolution, with domains like 24carnforth2merseyside[.]sol supplying infrastructure records.
Guardio Labs is a cybersecurity company that first publicly documented the EtherHiding technique in October 2023. Their research highlighted how attackers embed…