#ESETresearch has observed DeadLock ransomware expanding its use of Polygon blockchain smart contracts. Previously used only for chat proxy server address rotation, DeadLock has now added a new contract with the gang's DLS entries - a first of its kind we are aware of. DeadLock’s HTML ransom notes are interactive, providing access to a Session-style messaging client and now also the DLS, that is displayed to victims directly embedded in the HTML ransom note, fetched on the fly from the smart contracts. The "Blog" smart contract, containing the DLS, had its first transaction on 2026-02-08 and has since accumulated 75 victims. ESET researchers first saw the contract used in a ransom note in March 2026. The older chat proxy contract has been active since August 2025. On top of the on-chain DLS, DeadLock recently registered a clearweb domain deadlock.liveblog365[.]com. The site works the same way as their HTML ransom notes - both query the Blog smart contract for victim data, combining blockchain resilience with clearweb accessibility. For prior analysis of DeadLock's Polygon smart contract infrastructure, see: @ThreatScene: threatscene.com/blog-update/ransomware-over-webchat-deadlock/ @GroupIB_TI: group-ib.com/blog/deadlock-ransomware-polygon-smart-contracts H/T @ecrime_ch for indexing the clearweb DLS. DLS smart contract: 0x757984507c82c8dA1d3969c535dB5706eEE6426C Chat proxy smart contract: 0x8EF7c3e531d871D3B9D559722DE77EB1dEc19dAe