DeadBolt ransomware attacks Qnap NAS devices and demands 50 BTC for master key

Security researchers and Qnap engineers have warned about the emergence of a new DeadBolt ransomware that attacks Qnap NAS. According to the hackers themselves, the DeadBolt malware encrypts devices using a 0-day vulnerability.

Bleeping Computer reports that the attacks began on January 25, when owners of Qnap devices began to discover that their files were encrypted and their file names were suffixed with .deadbolt. The media source is aware of at least 15 victims of the new malware. Instead of a ransom note, which is usually placed in every folder on the device, the message of the hackers is placed right on the login page, as shown below.

DeadBolt attacks Qnap NAS

The victim is informed that it is necessary to transfer 0.03 bitcoin (approximately $1,100) to a specific bitcoin address that is unique to each victim. After the payment, the attackers inform that they will make a return transaction to the same address, which will include a key to decrypt the data.

Journalists emphasize that at present there is no evidence that the payment of the ransom will generally lead to the receipt of the key, and users will be able to decrypt their files.

DeadBolt attacks Qnap NAS

Interestingly, the ransom note has a separate link titledImportant message for Qnap”, which, when clicked, displays a message to the developers. The authors of the DeadBolt malware write that they are ready to disclose all details of the zero-day vulnerability they exploit if the company pays them 5 bitcoins (approximately $184,000). They also report that they are ready to sell a master key that will help decrypt the files of all victims, and information about 0-day for 50 bitcoins, that is, for almost 1.85 million US dollars.

DeadBolt attacks Qnap NAS

Ransomware operators argue that they can only be contacted through bitcoin payments.
Qnap developers have already confirmed information about DeadBolt attacks. The company warns users:

DeadBolt attacks all NAS connected to the Internet without any protection and encrypts user data in order to collect a ransom in bitcoins. If your NAS is connected to the internet, it is at high risk if the control panel displays the message “The system administration service can be directly accessed from an external IP address using the following protocols: HTTP”.
Users are strongly advised to update QTS to the latest available version and disable port forwarding on their router and UPnP function on Qnap NAS as soon as possible.

Let me remind you that we wrote that The FBI linked the Diavol ransomware to the authors of the TrickBot malware, and also that Khonsari ransomware attacks Minecraft servers.

हेल्गा स्मिथ

मुझे हमेशा से कंप्यूटर विज्ञान में रुचि थी, विशेष रूप से डेटा सुरक्षा और विषय, जिसे आजकल कहा जाता है "डेटा विज्ञान", मेरी शुरुआती किशोरावस्था से ही. मुख्य संपादक के रूप में वायरस रिमूवल टीम में आने से पहले, मैंने कई कंपनियों में साइबर सुरक्षा विशेषज्ञ के रूप में काम किया, जिसमें अमेज़न का एक ठेकेदार भी शामिल है. एक और अनुभव: मुझे आर्डेन और रीडिंग विश्वविद्यालयों में पढ़ाना है.

उत्तर छोड़ दें

यह साइट स्पैम को कम करने के लिए Akismet का उपयोग करती है. जानें कि आपका टिप्पणी डेटा कैसे संसाधित किया जाता है.

शीर्ष पर वापस जाएँ बटन