Deadbolt, a ransomware variant that attacked QNAP storage in January, is back and infecting more of the drives, researchers revealed this week.
Deadbolt is a ransomware variant first identified in January. It targets network-attached storage (NAS) devices from QNAP, which run the company's own Linux distribution called QTS.
Rather than encrypting the whole drive, Deadbolt concentrates on encrypting backup drives and then hacks the device's web interface to deliver a ransomware message.
Infections peaked on January 26, according to cyber security company Censys, affecting almost 5,000 of the 130,000 QNAP devices in use. QNAP force updated its firmware in January to stop the infections.
This update reportedly caused side effects including broken iSCSI connections. It also removed the hacked interface, which stopped hacked users who had paid the ransom from decrypting the files. However, Censys said that it reduced the number of infected devices at the time to under 300.
The ransomware resurged on QNAP devices this month. Censys saw new infections beginning on March 16, when the number of infected devices stood at 373. Within three days, the number of infected devices had grown to 1,146.
While the attackers are using a different Bitcoin address for the latest ransom demand, the rest of the attack remains the same, Censys said. They are demanding 0.03 bitcoins (currently worth around $1,280).
RELATED RESOURCE
Identity is key to stopping these five cyber security attacks
Many attacks begin with the same weakness: user accounts
The attackers promise to deliver a decryption key in exchange for the ransom payment. They also make a separate offer to QNAP via the hacked web interface, offering it full details of the technical exploit that enabled the attack for five bitcoins ($213,300) or a master decryption key for 50 bitcoins ($2.13m).
This attack is unusual, in that aside from the hacked web interface, the attackers only communicate with the victims via bitcoin payments. They return the encryption key from a ransom payment in the OPRETURN field of a Bitcoin transaction.
QNAP drives have suffered attacks before, including infection by Dovecat crypto-mining malware and QSnatch, legacy malware which stopped administrators from applying security patches.
-
AWS targets IT modernization gains with new agentic AI features in TransformNews New custom agents aim to speed up legacy code modernization and mainframe overhauls
-
HSBC partners with Mistral to fuel bank-wide generative AI adoptionNews The multi-year, strategic partnership will focus on transforming a range of services and tasks from customer-facing to fraud detection and more
-
15-year-old revealed as key player in Scattered LAPSUS$ HuntersNews 'Rey' says he's trying to leave Scattered LAPSUS$ Hunters and is prepared to cooperate with law enforcement
-
The Scattered Lapsus$ Hunters group is targeting Zendesk customers – here’s what you need to knowNews The group appears to be infecting support and help-desk personnel with remote access trojans and other forms of malware
-
Impact of Asahi cyber attack laid bare as company confirms 1.5 million customers exposedNews No ransom has been paid, said president and group CEO Atsushi Katsuki, and the company is restoring its systems
-
The US, UK, and Australia just imposed sanctions on a Russian cyber crime group – 'we are exposing their dark networks and going after those responsible'News Media Land offers 'bulletproof' hosting services used for ransomware and DDoS attacks around the world
-
A notorious ransomware group is spreading fake Microsoft Teams ads to snare victimsNews The Rhysida ransomware group is leveraging Trusted Signing from Microsoft to lend plausibility to its activities
-
Volkswagen confirms security ‘incident’ amid ransomware breach claimsNews Volkswagen has confirmed a security "incident" has occurred, but insists no IT systems have been compromised.
-
The number of ransomware groups rockets as new, smaller players emergeNews The good news is that the number of victims remains steady
-
Teens arrested over nursery chain Kido hacknews The ransom attack caused widespread shock when the hackers published children's personal data
