DeadLock Malware Exploits Polygon Good Contracts to Cover

A recently-discovered ransomware dubbed “DeadLock” is stealthily exploiting Polygon sensible contracts to rotate and distribute proxy addresses, say researchers at cybersecurity agency Group-IB.

The corporate reported on Thursday that the DeadLock ransomware, first found in July, has seen “low publicity” because it isn’t tied to any recognized information leak web site or affiliate packages and has a “restricted variety of reported victims.”

Nonetheless, Group-IB warned that despite the fact that the ransomware is “low profile,” it makes use of “modern strategies” that could possibly be harmful to organizations that don’t take the malware critically, “particularly for the reason that abuse of this particular blockchain for malicious functions has not been broadly reported.”

DeadLock leverages Polygon sensible contracts to retailer and rotate proxy server addresses used to speak with victims. Code embedded within the ransomware interacts with a particular sensible contract tackle and makes use of a operate to dynamically replace command-and-control infrastructure.

As soon as victims have been contaminated with the malware and encryption has occurred, DeadLock threatens them with a ransom observe and the promoting of stolen information if their calls for usually are not met.

Infinite variants of the approach might be utilized

By storing proxy addresses on-chain, Group-IB stated DeadLock creates infrastructure that’s extraordinarily troublesome to disrupt, as there isn’t any central server to take down, and blockchain information persists indefinitely throughout distributed nodes worldwide.

Associated: Hackers discover new approach to cover malware in Ethereum sensible contracts

“This exploit of sensible contracts to ship proxy addresses is an fascinating methodology the place attackers can actually apply infinite variants of this system; creativeness is the restrict,” it added.

North Korean risk actors discovered “EtherHiding” 

Weaponizing sensible contracts for malware dissemination is just not new, with Group-IB noting a tactic referred to as “EtherHiding” that Google reported in October.