According to Group-IB monitoring, the DeadLock ransomware family is exploiting the Polygon smart contract to distribute and rotate proxy server addresses to evade security detection. First discovered in July 2025, this malware uses embedded JavaScript code that interacts with the Polygon network within HTML files, leveraging an RPC list as a gateway to obtain attacker-controlled server addresses. This technique is similar to the previously discovered EtherHiding, aiming to build difficult-to-hide covert communication channels using a decentralized ledger. DeadLock currently has at least three variants, with the latest version embedding the encrypted communication application Session for direct communication with victims.