A new strain of ransomware called DeadLock is leveraging Polygon smart contracts in unexpected ways—using the blockchain to store and dynamically rotate proxy addresses for its command-and-control infrastructure. This approach creates a resilient C2 layer that's notoriously hard to take down. Since its initial emergence in July, the malware has managed to evade traditional takedown efforts by hiding in plain sight on the blockchain. The tactic bears similarities to techniques previously associated with state-sponsored actors, like the EtherHiding method. For security teams monitoring the Polygon ecosystem, this represents a growing concern: attackers are weaponizing smart contracts not for financial gain, but as operational infrastructure.