IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

QNAP NAS drives targeted by DeadBolt ransomware for the third time this year

The ransomware strain is back and equipped with stronger cryptography for more effective attacks

Taiwanese tech company QNAP has warned that DeadBolt ransomware is targeting owners of its network-attached storage (NAS) drives for the third time this year.

Following initial attacks by DeadBolt in January 2022, QNAP took the highly controversial decision to force-update users’ drives to firmware versions DeadBolt couldn’t successfully exploit.

The campaign then re-emerged in March after a period of downtime, infecting more than 1,000 devices, according to Censys.

The latest ransomware campaign is primarily targeting NAS drives running QTS firmware version 4.3.6 and 4.4.1, QNAP said – a narrower target pool than the initial incident earlier this year.

QNAP also said the affected models were mainly the TS-x51 series and TS-x53 series of NAS drives. The advice given to users who believe they be vulnerable to DeadBolt is to update to the latest version of QTS and avoid exposing their product to the internet.

QNAP officially confirmed the third DeadBolt campaign on 19 May, but Unit 42 researchers said users may have been targeted as early as 13 May.

There has been no substantial analysis of the latest version of DeadBolt, but Unit 42 said the ransomware program made some significant changes since the March campaign.

Specifically, the DeadBolt program now uses revised JavaScript code with a stronger SHA-256 implementation, building on the previous, lower-level ‘SubtleCrypto’ cryptography. Unit 42 researchers said this was likely changed to a stronger standard to accelerate the key verification process and also to ensure the verification works on browsers that do not support the SubtleCrypto API.

In addition to a revised back end, DeadBolt also has a new ransom note and updated CSS code, along with the same master key as previously used. Unit 42 believes the latest campaign has infected around 3,000 devices.

Quickfire QNAP-DeadBolt overview

QNAP’s NAS drives were targeted by DeadBolt ransomware as of 7 January 2022. At the time, the type of ransomware used against the products was not known and neither was the scope of the attack.

On 25 January, both individual and business users started reporting infections with ransom demands set at 0.3 Bitcoin for individual users, or 50 Bitcoin from QNAP in exchange for the ransomware actors backing down.

Related Resource

The sweet spot of modern enterprise computing

Achieve security, reliability, scalability, and sustainability with hybrid IT infrastructure

Blue whitepaper cover with image of a computer chip with glowing lights and cloud, thought and padlock graphicsFree Download

The next day, QNAP advised all users to update their devices, a day before the company made the controversial move to force-update vulnerable hardware.

The move was met with anger from corners of the QNAP community. Many users had finely tuned NAS configurations that were undone with the update and some complained they were left no more secure than before the company forced the firmware update.

Others were more aggrieved at the company’s decision to force the update in the first place, the main argument being that users should have the choice to update or not, given that it was their product.

According to Censys, the first DeadBolt campaign infected just shy of 5,000 devices and the second affected more than 1,000.

Featured Resources

The Total Economic Impact™ Of Turbonomic Application Resource Management for IBM Cloud® Paks

Business benefits and cost savings enabled by IBM Turbonomic Application Resource Management

Free Download

The Total Economic Impact™ of IBM Watson Assistant

Cost savings and business benefits enabled by Watson Assistant

Free Download

The field guide to application modernisation

Moving forward with your enterprise application portfolio

Free Download

AI for customer service

Discover the industry-leading AI platform that customers and employees want to use

Free Download

Recommended

Qnap TS-873AU-RP review: A great storage package in a space-saving chassis
network attached storage (NAS)

Qnap TS-873AU-RP review: A great storage package in a space-saving chassis

16 Aug 2022
Ransomware now strikes one in 40 organisations per week, Check Point finds
ransomware

Ransomware now strikes one in 40 organisations per week, Check Point finds

27 Jul 2022
Qnap TS-1264U-RP review: Space to spare
network attached storage (NAS)

Qnap TS-1264U-RP review: Space to spare

4 May 2022
Darktrace AI’s Antigena helps stop ransomware attack at Dordogne GHT
ransomware

Darktrace AI’s Antigena helps stop ransomware attack at Dordogne GHT

13 Apr 2022

Most Popular

UK water supplier confirms hack by Cl0p ransomware gang
ransomware

UK water supplier confirms hack by Cl0p ransomware gang

16 Aug 2022
Why convenience is the biggest threat to your security
Sponsored

Why convenience is the biggest threat to your security

8 Aug 2022
How to boot Windows 11 in Safe Mode
Microsoft Windows

How to boot Windows 11 in Safe Mode

29 Jul 2022