Asustor NAS devices hit by Deadbolt ransomware attack

Image Credit: Shutterstock (Image credit: Shutterstock)

Following ransomware attacks against QNAP NAS devices, it is now Asustor’s turn to suffer, according to multiple reports of Asustor NAS devices being attacked by the DeadBolt ransomware.

It's still not known exactly how the attackers managed to compromise Asustor devices, as well as which models are susceptible to the attack. This is partly because the company is still keeping quiet about it, but user should hopefully receive a statement, as well as a patch, sooner rather than later.

Allegedly, AS6602T, AS-6210T-4K, AS5304T, AS6102T, or AS5304T are invulnerable to these attacks, while AS5304T, AS6404T, AS5104T, and AS7004T, seem to be affected.

No ransom demand yet

Initial reports suggest that the attackers managed to compromise a vulnerability found in Asustor's EZ Connect utility, a feature that allows users to connect to the NAS system remotely.

The attackers have made no ransom demands yet.

In the case of QNAP, which was also attacked with DeadBolt, the operators demanded 0.03 bitcoin, or approximately $1,100, at press time. They also offered to sell the details on the vulnerability itself for five bitcoin (around $185,000), as well as a master decryption key against the malware for 50 bitcoin ($1.85 million).

> QNAP NAS devices hit with surge of ransomware attacks

> QNAP NAS devices left encrypted by Deadbolt ransomware

> QNAP extends support for older NAS devices amid surge in attacks

Until we hear from Asustor, the best way to stay safe is to disconnect the endpoints from the internet entirely. Users who own one of the unaffected variants, but still would like to make some security precautions, should disable EZ Connect, automatic updates, SSH, block all NAS ports from the router, and only allow connections from within the network, some Asustor users are suggesting.

QNAP users have had it rough, lately. Besides being attacked by Deadbolt, they also suffered a ransomware attack at the hands of eCh0raix ransomware. In late December last year, the affected users were demanded between .024 and .06 bitcoin ($880 - $2,200) for the decryption key.

A free decryptor is available online, but only for older versions of the ransomware. For the newer versions (1.0.5. and 1.0.6.), there is currently no free option to decrypt data following an infection.

To keep NAS devices secure and shield against future attacks, QNAP has prepared a series of recommendations and best practices, which can be found here.

These are the best NAS hard drives right now

Via: Tom's Hardware

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.