DeadLock Ransomware C2 via Polygon RPC

Ucy Chima@Chima

•updated Jan 29, 2026•13•1•149

Detects network connections to Polygon (MATIC) blockchain RPC endpoints. The DeadLock ransomware strain has been observed using smart contracts on the Polygon network to retrieve C2 proxy server addresses, making this a key indicator of compromise.