DeadLock Ransomware Moves Its Infrastructure Onto the Blockchain to Dodge Takedowns
A ransomware operation calling itself DeadLock has adopted a decentralized hosting setup for the infrastructure it uses to negotiate with victims and publish stolen data, according to researchers. Instead of relying solely on traditional web hosting or Tor-based sites that can be knocked offline with a single server seizure, the group is routing key services through blockchain-backed platforms that distribute content across many nodes rather than one central point.
That approach mirrors a tactic other cybercriminals have experimented with in recent years: using decentralized naming systems or storage networks so that no single company or law enforcement agency can simply pull the plug. For DeadLock, this means its victim communication portals and data-leak pages are harder to disrupt through the usual playbook of seizing domains, pressuring hosting providers, or coordinating takedowns with registrars.
Security researchers tracking the group say this doesn't make DeadLock's operation invincible, but it does raise the bar for defenders and investigators who typically rely on quickly identifying and dismantling ransomware backend infrastructure to limit damage and gather evidence.