A recently-discovered ransomware dubbed “DeadLock” is stealthily exploiting Polygon smart contracts to rotate and distribute proxy addresses, according to researchers at cybersecurity firm Group-IB.
The company reported on Thursday that the DeadLock ransomware, first discovered in July, has seen “low exposure” as it isn’t tied to any known data leak site or affiliate programs and has a “limited number of reported victims.”
However, Group-IB warned that even though the ransomware is “low profile,” it uses “innovative methods” that could be dangerous to organizations that don’t take the malware seriously, “especially since the abuse of this specific blockchain for malicious purposes has not been widely reported.”
DeadLock leverages Polygon smart contracts to store and rotate proxy server addresses used to communicate with victims. Code embedded in the ransomware interacts with a specific smart contract address and uses a function to dynamically update command-and-control infrastructure.
Once victims have been infected with the malware and encryption has occurred, DeadLock threatens them with a ransom note and the selling of stolen data if their demands are not met.
Resilient Infrastructure Through Blockchain Storage
By storing proxy addresses on-chain, Group-IB stated that DeadLock creates infrastructure that is extremely difficult to disrupt. This is because there is no central server to take down, and blockchain data persists indefinitely across distributed nodes worldwide.
The firm added, “This exploit of smart contracts to deliver proxy addresses is an interesting method where attackers can literally apply infinite variants of this technique; imagination is the limit.”
Comparison to "EtherHiding" Technique
Weaponizing smart contracts for malware dissemination is not a new tactic. Group-IB noted a similar method called “EtherHiding,” which Google reported on in October.
A North Korean threat actor dubbed “UNC5342” utilized this technique, which consists of leveraging transactions on public blockchains to store and retrieve malicious payloads, according to the firm.
EtherHiding involves embedding malicious code, often in the form of JavaScript payloads, within a smart contract on a public blockchain, as explained by Google at the time.
“This approach essentially turns the blockchain into a decentralized and highly resilient command-and-control (C2) server.”