Deadlock is the most technically novel ransomware group to surface in 2026. After roughly 11 months operating underground, it emerged publicly in June 2026, when researchers logged around 75 victims in a single month. Its signature is command-and-control built on Polygon smart contracts, a decentralized channel that is far harder to seize or sinkhole than ordinary servers, paired with kernel-level EDR termination through a vulnerable driver (CVE-2024-51324). Deadlock negotiates over the Session messenger. It is a preview of what takedown-resistant ransomware infrastructure looks like.
Who is Deadlock?
Deadlock is a ransomware operation that developed quietly for about 11 months before its public emergence in June 2026. It draws attention less for volume than for tradecraft: it engineered its infrastructure to survive the exact disruption tactics law enforcement has leaned on against groups like LockBit. Group-IB and other vendors flagged it as an emerging threat worth watching. For context on the wider field, see the Ransomnews threat-group catalogue and the live Ransomtracker feed.
Why smart-contract command-and-control matters
Traditional command-and-control relies on servers and domains that defenders and police can seize, block, or sinkhole. Deadlock instead reads its instructions from smart contracts on the Polygon blockchain. A blockchain has no single server to take down and no domain to revoke, and updates written to a contract propagate to every implant that queries it. To disrupt this channel, defenders would have to block the malware’s ability to reach the blockchain at all, a far harder proposition than pulling a hosting provider’s plug. It is decentralization repurposed as resilience for crime.
What else does Deadlock do?
Beyond its C2, Deadlock uses a vulnerable driver, tracked as CVE-2024-51324, to terminate endpoint detection at the kernel level before encrypting, the same bring-your-own-vulnerable-driver pattern seen across 2026’s top operations. Negotiations run over Session, an encrypted messenger with no phone-number requirement, keeping communications off channels that are easier to monitor. The combination, resilient C2, kernel EDR-kill, and anonymized negotiation, shows a group optimizing every stage against the standard disruption and detection playbook.
What Deadlock signals for 2026 and beyond
Deadlock is a proof of concept that ransomware infrastructure can be built to outlast takedowns. If smart-contract C2 proves reliable at scale, it undercuts one of law enforcement’s most effective tools: seizing and sinkholing infrastructure. Other groups will watch whether Deadlock’s approach holds up operationally. For defenders, the implication is that stopping the intrusion earlier matters more than ever, because disrupting the malware’s infrastructure after the fact gets harder when that infrastructure lives on a public blockchain.
How to defend against Deadlock
Focus on the entry and pre-encryption phases, where Deadlock is still stoppable. Enable Microsoft’s vulnerable-driver blocklist to blunt the CVE-2024-51324 EDR-kill step, and alert on a new kernel driver loading before security services fail. Monitor for unexpected outbound connections to blockchain nodes or RPC endpoints from servers that have no business talking to them, a possible sign of smart-contract C2. Keep offline, tested backups, and prioritize closing initial-access vectors, since post-infection infrastructure disruption is unusually difficult here.
Frequently asked questions
What is Deadlock ransomware?
Deadlock is a ransomware group that emerged publicly in June 2026 after about 11 months underground. It is known for command-and-control built on Polygon smart contracts and kernel-level EDR termination.
How does Deadlock’s blockchain C2 work?
Deadlock reads instructions from smart contracts on the Polygon blockchain instead of from seizable servers or domains, making its command-and-control channel highly resistant to takedown and sinkholing.
Why is smart-contract C2 hard to stop?
A blockchain has no central server to seize or domain to revoke, and instructions written to a contract reach every implant that queries it. Disrupting it requires blocking the malware’s access to the blockchain entirely.
Does Deadlock bypass EDR?
Yes. Deadlock uses a vulnerable driver tracked as CVE-2024-51324 to terminate endpoint detection at the kernel level before encrypting, a bring-your-own-vulnerable-driver technique.
How can defenders stop Deadlock?
Concentrate on initial access and the pre-encryption phase: block vulnerable drivers, alert on suspicious kernel-driver loads and unexpected blockchain-node connections, and keep offline backups, since disrupting its C2 after infection is very hard.