DeadBolt ransomware attacks Qnap NAS devices and demands 50 BTC for master key

Security researchers and Qnap engineers have warned about the emergence of a new DeadBolt ransomware that attacks Qnap NAS. According to the hackers themselves, the DeadBolt malware encrypts devices using a 0-day vulnerability.

Bleeping Computer reports that the attacks began on January 25, when owners of Qnap devices began to discover that their files were encrypted and their file names were suffixed with .deadbolt. The media source is aware of at least 15 victims of the new malware. Instead of a ransom note, which is usually placed in every folder on the device, the message of the hackers is placed right on the login page, as shown below.

DeadBolt attacks Qnap NAS

The victim is informed that it is necessary to transfer 0.03 bitcoin (approximately $1,100) to a specific bitcoin address that is unique to each victim. After the payment, the attackers inform that they will make a return transaction to the same address, which will include a key to decrypt the data.

Journalists emphasize that at present there is no evidence that the payment of the ransom will generally lead to the receipt of the key, and users will be able to decrypt their files.

DeadBolt attacks Qnap NAS

Interestingly, the ransom note has a separate link titledImportant message for Qnap”, cái mà, when clicked, displays a message to the developers. The authors of the DeadBolt malware write that they are ready to disclose all details of the zero-day vulnerability they exploit if the company pays them 5 bitcoins (approximately $184,000). They also report that they are ready to sell a master key that will help decrypt the files of all victims, and information about 0-day for 50 bitcoins, that is, for almost 1.85 million US dollars.

DeadBolt attacks Qnap NAS

Ransomware operators argue that they can only be contacted through bitcoin payments.
Qnap developers have already confirmed information about DeadBolt attacks. The company warns users:

DeadBolt attacks all NAS connected to the Internet without any protection and encrypts user data in order to collect a ransom in bitcoins. If your NAS is connected to the internet, it is at high risk if the control panel displays the message “The system administration service can be directly accessed from an external IP address using the following protocols: HTTP”.
Users are strongly advised to update QTS to the latest available version and disable port forwarding on their router and UPnP function on Qnap NAS as soon as possible.

Let me remind you that we wrote that The FBI linked the Diavol ransomware to the authors of the TrickBot phần mềm độc hại, và đó cũng là Khonsari ransomware attacks Minecraft servers.

Helga Smith

Tôi luôn quan tâm đến khoa học máy tính, đặc biệt là bảo mật dữ liệu và chủ đề, được gọi là ngày nay "khoa học dữ liệu", kể từ khi tôi còn ở tuổi thiếu niên. Trước khi vào nhóm Diệt Virus với vai trò Tổng biên tập, Tôi đã làm việc với tư cách là chuyên gia an ninh mạng tại một số công ty, bao gồm một trong những nhà thầu của Amazon. Một trải nghiệm khác: Tôi đã nhận được đang giảng dạy tại các trường đại học Arden và Reading.

Gửi phản hồi

Website này sử dụng Akismet để hạn chế spam. Tìm hiểu bình luận của bạn được duyệt như thế nào.

Nút quay lại đầu trang