We Called Blockchain C2 'Early' in July. DeadLock Had Been Running It as a Business Since August 2025, and Group-IB Published It in January.

Our morning sweep flagged one real gap today: DeadLock ransomware, which stores its command-and-control configuration in Polygon smart contracts. Six outlets ran it in the last forty-eight hours off a Microsoft writeup dated August 10.

We had no coverage. So we went to write it, and the research produced a better story than the gap did — one that costs us something.

The Thing We Got Wrong

On July 16 we published a post about Starland RAT, a credential stealer that keeps a backup command-and-control address in a Polygon smart contract. We wrote that decentralized C2 resilience was "worth naming now, while it is still early, rather than after it is everywhere."

That sentence was wrong, and the receipts are public.

Group-IB documented DeadLock using Polygon smart contracts to rotate its C2 proxy addresses on January 15, 2026 — six months before we called the technique early. The Register covered it the day before. And the contracts themselves were deployed on the Polygon chain on August 10 and 11, 2025, by a wallet the researchers traced. The earliest DeadLock sample dates to June 27, 2025.

So when we described blockchain-anchored C2 as an emerging pattern worth naming early, a financially motivated ransomware crew had been running it in production for eleven months, and a major vendor had published the analysis six months earlier.

We were not early. We were describing a mature technique as if it were a forecast.

Why That Distinction Is the Whole Product

We say constantly that the game is speed to truth and accuracy. Accuracy includes being accurate about ourselves. A claim like "this is early" is a claim about the state of the world, and it is checkable — which means when it is wrong, it is wrong in public and stays wrong until somebody says otherwise.

Here is the part that should have caught it: the check was cheap. One search for prior coverage of blockchain C2 in ransomware would have surfaced the January Group-IB work. We ran the corpus check against our own archive, confirmed we had not covered it, and stopped there. Checking whether we had written about something is not the same as checking whether the field had. We conflated the two, and the false confidence came out as "early."

That is a process defect, not a typo. It is the same shape as the ingest-time-is-not-detection-time error we corrected a year ago: our own timeline was mistaken for the world's timeline.

What DeadLock Actually Does

Now the technical substance, because it is genuinely worth your time even seven months late.

DeadLock is a Rust-based double-extortion operation first detected in July 2025. It has claimed roughly 96 victims, concentrated in Italy, Spain, Poland, Türkiye and the United States. The encryptor is unremarkable. The infrastructure is not.

Rather than hosting its command-and-control configuration on a domain that can be seized, sinkholed, or served a takedown notice, DeadLock writes it to smart contracts on Polygon. Group-IB identified contracts at 0x8EF7c3e531d871D3B9D559722DE77EB1dEc19dAe and 0xAc9f868E285C8141617a97b85b667f229147815c holding proxy server URLs, written through a setProxy function. Both were created by the same deployer wallet, 0x8f2fef1339E0d90362F3cEAd9C27B661d964a022, in August 2025. The August 2026 reporting adds a second role: a contract storing leak-blog content directly on chain.

The victim-facing side matches the philosophy. DeadLock drops a RECOVERY_CHAT HTML file that is a self-contained application — an end-to-end encrypted chat bridged to the Session messenger, a paginated leak blog, and a file browser — with no conventional backend behind it. There is no negotiation portal to raid because there is no negotiation server.

The Detail Defenders Should Actually Care About

The malware retrieves its proxy address using a read-only contract call. On Ethereum-family chains that is an eth_call: it does not create a transaction, does not consume gas, and does not appear in the chain's transaction history.

Sit with that for a second, because it cuts both ways and most of the coverage only reported one side.

The attacker's win: the fetch is invisible. There is no on-chain record that a victim machine ever read the contract. You cannot enumerate infected hosts by watching the blockchain, and you cannot block the lookup by blocking a domain, because the lookup goes to a public RPC endpoint that thousands of legitimate applications also use.

The attacker's problem, which nobody seems to be saying out loud: every write is permanent and public. Each time the operators rotate the proxy URL, that rotation is a transaction — timestamped, attributed to their wallet, and immutable. They built infrastructure that cannot be taken down, and in exchange they accepted infrastructure that cannot be hidden, cannot be deleted, and keeps a perfect audit log of its own operational tempo forever.

This is the subtraction pattern we have written about before: the attacker wins by removing the artifact the defense assumes exists. There is no domain to seize, no host to raid, no registrar to serve. But subtraction is a trade, not a free win, and here the trade is legibility.

The Free Counter-Move

You cannot take the contract down. You can subscribe to it.

A defender — including a defender with no budget, which is who we build for — can watch those contract addresses for write events using a free public Polygon RPC endpoint or any block explorer's alert feature. When the operators rotate to a new proxy, the new address is published to a ledger you are already reading, at the moment they publish it, before it has been used against anyone.

Read that again in operational terms: the extortion crew's C2 rotation notice arrives on a public broadcast channel, and the notification is free. Traditional infrastructure gives you a takedown target but no advance warning. This gives you no takedown target but continuous advance warning. For most defenders the second is worth more, and it costs nothing.

The deployer wallet is the higher-value pivot. Contracts rotate; the wallet that deployed them is the thread that survives rotation and can reveal contracts nobody has catalogued yet.

What We Changed

Covering a campaign is not finished until its indicators are in the feed where somebody can pull and block them. So:

We added all four DeadLock addresses — both proxy contracts, the leak-content contract, and the deployer wallet — to our GitHub hunting signatures as literal-match queries, under a standing process we wrote in July for exactly this class of indicator. Literal match only: we proved in July that hunting the shape of blockchain C2 produces a flood of false positives from legitimate web3 code, while hunting the specific address is high-precision.

And we found a hole in our own plumbing while doing it. That July process said to write dead-drop addresses to our IOC index. We checked. The Starland contract address from our own July 16 post is not in the index — it returns not-found today. The likely cause is structural rather than forgetful: our verified ingest path validates indicator types against a fixed list of hash, IP, domain, URL, CVE, hostname and package. A blockchain address is none of those, so a write would be rejected as an invalid type.

Which means we defined a first-class indicator class, wrote a standing process to collect it, published about it twice, and never noticed that our own feed could not accept it. That is the exact failure mode we harp on: a green process with no product behind it. The fix is a code change to the ingest validation, and it is queued rather than shipped, because infrastructure changes here wait for an explicit go.

The Honest Ledger

We were seven months behind the published research and eleven months behind the operation. We claimed early on a technique that was mature. We found the error ourselves, while writing a different post, and we are publishing it rather than quietly fixing the old sentence.

Credit where it belongs: this analysis is Group-IB's, from January, with Xabier Eizaguirre's team doing the contract work, plus Microsoft's August encryptor breakdown. We did not find DeadLock. We are not claiming otherwise, and the timestamps above are there so you can check.

What we are adding is the read-versus-write asymmetry, the free monitoring counter-move, the deployer-wallet pivot, and four indicators in the hunting net. That is a smaller contribution than a scoop, and it is the accurate one.

As always, call it 95 percent. Something in here will be wrong, and we would rather you find it than not look.

---

Every indicator in this post is in the feed. Free.

1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.

Get your free key → analytics.dugganusa.com/stix/register

---

Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=we-called-blockchain-c2-early-in-july-deadlock-had-been-running-it-as-a-business-since-august-202