QNAP NAS devices left encrypted by Deadbolt ransomware

security
(Image credit: Shutterstock / binarydesign)

QNAP NAS devices across the globe have been hit by a widespread cyberattack after the DeadBolt ransomware group began to encrypt the network-attached storage devices.

QNAP NAS users reported finding their files encrypted, sporting a .deadbolt file extension.

Users were confronted by a screen displaying a “WARNING: Your files have been locked by DeadBolt” message that added “You can make a payment of (exactly) 0.030000 bitcoin to the following address.” 

Deadbolt decryption

The victims were given a decryption key to retrieve their files as part of a follow-up transaction, although there is no confirmation that paying the ransom will result in the successful decryption of files.

QNAP assured customers that they can access their admin page by navigating to http://nas_ip:8080/cgi-bin/index.cgi or https://nas_ip/cgi-bin/index.cgi. It also promises that its Product Security Incident Response Team is conducting an investigation.

Users are being told to take their devices offline and place them behind a firewall until a fix has been found. Without access to the Internet, attacks against network-attached storage devices (or any devices connected to a network, for that matter) should be impossible.

DeadBolt is offering to share with QNAP the zero-day vulnerability that allowed the ransomware group to gain access to the devices, at a cost of 5 BTC. This, and the master decryption key, will cost the company 50 BTC.

With no dedicated website or messaging service, the gang stated that the only way to make contact is through Bitcoin payments. However, the group promised to send the zero-day information to QNAP’s security@qnap.com email address.

Desire Athow
Managing Editor, TechRadar Pro

Désiré has been musing and writing about technology during a career spanning four decades. He dabbled in website builders and web hosting when DHTML and frames were in vogue and started narrating about the impact of technology on society just before the start of the Y2K hysteria at the turn of the last millennium.

Read more
A laptop with a red screen with a white skull on it with the message: "RANSOMWARE. All your files are encrypted."
AWS S3 feature abused by ransomware hackers to encrypt storage buckets
Digital image of a lock.
QNAP says it has fixed several major vulnerabilities in NAS backup, recovery app
Computer Hacked, System Error, Virus, Cyber attack, Malware Concept. Danger Symbol
Interlock ransomware attacks highlight need for greater security standards on critical infrastructure
Representational image of a hacker
TrueNAS device vulnerabilities exposed during hacking competition
Image of laptop infected with malware
Ransomware criminals are now sending their demands...by snail mail?
Ransomware
Synology patches critical vulnerabilities, urges users to update devices against zero-click attacks
Latest in Security
ransomware avast
Ransomware attacks are costing Government offices a month of downtime on average
Lock on Laptop Screen
Data breach at Pennsylvania education union potentially exposes 500,000 victims
Data leak
Top collectibles site leaks personal data of nearly a million users
Spyware
Stalkerware data breach potentially hits over 2 million users, including thousands of Apple devices
An American flag flying outside the US Capitol building against a blue sky
Five Eyes "cannot replace US intel in Ukraine", claims former US Cyber Command Chief
Pirate skull cyber attack digital technology flag cyber on on computer CPU in background. Darknet and cybercrime banner cyberattack and espionage concept illustration.
Criminals are using a virtual hard disk image file to host and distribute dangerous malware
Latest in News
Wonka poster
Netflix cooks up sweet new reality TV series based on Charlie and the Chocolate Factory, and it's a dream come true for me
Citroen 2CV
The retro EV resurgence is in full swing, as Citroen confirms the iconic 2CV will return with batteries
Hugging Snap
This AI app claims it can see what I'm looking at – which it mostly can
Apple iPhone 16 Pro Max REVIEW
The latest batch of leaked iPhone 17 dummy units appear to show where glass meets metal on the new designs
Hornet swings their weapon in mid air
Hollow Knight: Silksong could potentially launch this year and I reckon it could be a great game for an Xbox handheld
ransomware avast
Ransomware attacks are costing Government offices a month of downtime on average