DeadBolt — Ransomware Profile

DeadBolt is a ransomware operation that went after internet-exposed network-attached storage appliances rather than corporate networks. Trend Micro dates it to January 2022 against QNAP hardware, and Dutch police later counted more than 20,000 encrypted QNAP and Asustor devices. The malware encrypts with AES-128-CBC and replaces the appliance's legitimate CGI script so that the web administration page itself becomes the ransom note. Its extortion model was two-tiered and fully automated: individual owners were charged roughly 0.03 to 0.05 BTC, while the NAS vendor was separately offered the vulnerability details for 5 bitcoin or a claimed master decryption key for 50 bitcoin, and victims never dealt with a human because the decryption key was returned inside the Bitcoin transaction that paid the ransom. That automation was turned against the operators in 2022, when the Dutch National Police obtained 155 decryption keys by paying ransoms and cancelling the transactions before they confirmed on chain. QNAP tracked repeated waves across 2022, including a campaign detected on 3 September 2022 against internet-facing Photo Station installations exploiting CVE-2022-27593; no source publicly attributes the operators to any country.

Vendor research

Closing the Door: DeadBolt Ransomware Locks Out Vendors With Multitiered Extortion Scheme Trend Micro
DeadBolt Ransomware - Security Advisory QSA-22-24 QNAP Systems
Deadbolt ransomware decryption: unlock your data Group-IB
Tracking Deadbolt Ransomware Across the Globe Censys

Read the full analysis on IntelFusions