DeadLock Malware Exploits Polygon Smart Contracts to Hide

A recently-discovered ransomware dubbed “DeadLock” is stealthily exploiting Polygon sensible contracts to rotate and distribute proxy addresses, say researchers at cybersecurity agency Group-IB.

The corporate reported on Thursday that the DeadLock ransomware, first found in July, has seen “low publicity” because it isn’t tied to any recognized information leak website or affiliate applications and has a “restricted variety of reported victims.”

Nevertheless, Group-IB warned that despite the fact that the ransomware is “low profile,” it makes use of “progressive strategies” that may very well be harmful to organizations that don’t take the malware severely, “particularly for the reason that abuse of this particular blockchain for malicious functions has not been extensively reported.”

DeadLock leverages Polygon sensible contracts to retailer and rotate proxy server addresses used to speak with victims. Code embedded within the ransomware interacts with a particular sensible contract deal with and makes use of a operate to dynamically replace command-and-control infrastructure.

As soon as victims have been contaminated with the malware and encryption has occurred, DeadLock threatens them with a ransom notice and the promoting of stolen information if their calls for aren’t met.

Infinite variants of the method could be utilized

By storing proxy addresses on-chain, Group-IB stated DeadLock creates infrastructure that’s extraordinarily tough to disrupt, as there isn’t a central server to take down, and blockchain information persists indefinitely throughout distributed nodes worldwide.

Associated: Hackers discover new approach to conceal malware in Ethereum sensible contracts

“This exploit of sensible contracts to ship proxy addresses is an fascinating technique the place attackers can actually apply infinite variants of this system; creativeness is the restrict,” it added.

North Korean menace actors discovered “EtherHiding” 

Weaponizing sensible contracts for malware dissemination will not be new, with Group-IB noting a tactic known as “EtherHiding” that Google reported in October.