Deadbolt Ransomware Goes After QNAP NAS Devices
QNAP Network Attached Storage (NAS) devices are once again under attack by ransomware. This time, the criminals are using a piece of malware known as the DeadBolt Ransomware. Unfortunately, it appears to be impossible to decrypt via free tools, and victims might have a hard time restoring the data on their QNAP devices. Currently, the only viable way to undo the damage that the DeadBolt Ransomware does is to restore from a backup.
When the DeadBolt Ransomware infiltrates a QNAP NAS device, it will immediately launch a file-locking attack. During this process, it will attempt to encrypt as many files as possible, appending the '.deadbolt' extension to their name. It then hijacks the device's login page, and replaces it with a pre-made message, which contains the ransom note. Victims are told to pay a ransom fee of 0.03 Bitcoin (about $1,100 for the decryptor.)
It appears that the DeadBolt Ransomware are targeting QNAP devices specifically, and they might be using an unknown exploit. Their ransom message also includes a section, which is meant for the QNAP vendor to read. In this excerpt, the criminals make the following proposals:
- They are willing to disclose the infection vector if QNAP pays 5 Bitcoin (about $184,000.)
- They will provide a master decryption key that works for all victims in exchange for 50 Bitcoin.
Last but not least, the criminals rely entirely on the Bitcoin network to communicate with their victims or QNAP. They ask to receive a transaction first, and claim to then send another transaction, which contains the instructions. Victims of the DeadBolt Ransomware are advised to refrain from paying the ransom fee, and to explore alternative data recovery options.
