DeadLock is the latest ransomware operation to weaponize blockchain technology for operational resilience, using decentralized infrastructure to decouple its victim communication and data-leak site from traditional hosting providers. This makes standard sinkholing or domain seizure largely ineffective.
Technical Breakdown: – TTPs: The group leverages blockchain-based DNS and decentralized storage (likely IPFS or similar) to host its leak site and negotiate with victims. This aligns with MITRE ATT&CK techniques T1588.002 (Obtain Capabilities: Tool) and T1485 (Data Destruction) for the encryption component. – IOCs: No specific hashes, IPs, or wallet addresses have been published yet. The key indicator is the use of .bit or .eth domains for the leak site, and any communication referencing blockchain-based messaging. – Affected Systems: Windows environments (standard ransomware targeting).
Defense: Traditional domain blocklists are insufficient. Focus on network-level detection of connections to known blockchain DNS resolvers (e.g., Alchemy, Infura) and monitor for anomalous outbound traffic to decentralized storage gateways. Endpoint detection rules should prioritize process injection and mass file encryption events, as the encryption payload itself is likely conventional.
Source: r/SecOpsDaily · by /u/falconupkid