QNAP NAS drives targeted by DeadBolt ransomware for the third time this year
The ransomware strain is back and equipped with stronger cryptography for more effective attacks


Taiwanese tech company QNAP has warned that DeadBolt ransomware is targeting owners of its network-attached storage (NAS) drives for the third time this year.
Following initial attacks by DeadBolt in January 2022, QNAP took the highly controversial decision to force-update users’ drives to firmware versions DeadBolt couldn’t successfully exploit.
The campaign then re-emerged in March after a period of downtime, infecting more than 1,000 devices, according to Censys.
The latest ransomware campaign is primarily targeting NAS drives running QTS firmware version 4.3.6 and 4.4.1, QNAP said – a narrower target pool than the initial incident earlier this year.
QNAP also said the affected models were mainly the TS-x51 series and TS-x53 series of NAS drives. The advice given to users who believe they be vulnerable to DeadBolt is to update to the latest version of QTS and avoid exposing their product to the internet.
QNAP officially confirmed the third DeadBolt campaign on 19 May, but Unit 42 researchers said users may have been targeted as early as 13 May.
There has been no substantial analysis of the latest version of DeadBolt, but Unit 42 said the ransomware program made some significant changes since the March campaign.
Get the ITPro daily newsletter
Sign up today and you will receive a free copy of our Future Focus 2025 report - the leading guidance on AI, cybersecurity and other IT challenges as per 700+ senior executives
Specifically, the DeadBolt program now uses revised JavaScript code with a stronger SHA-256 implementation, building on the previous, lower-level ‘SubtleCrypto’ cryptography. Unit 42 researchers said this was likely changed to a stronger standard to accelerate the key verification process and also to ensure the verification works on browsers that do not support the SubtleCrypto API.
In addition to a revised back end, DeadBolt also has a new ransom note and updated CSS code, along with the same master key as previously used. Unit 42 believes the latest campaign has infected around 3,000 devices.
Quickfire QNAP-DeadBolt overview
QNAP’s NAS drives were targeted by DeadBolt ransomware as of 7 January 2022. At the time, the type of ransomware used against the products was not known and neither was the scope of the attack.
On 25 January, both individual and business users started reporting infections with ransom demands set at 0.3 Bitcoin for individual users, or 50 Bitcoin from QNAP in exchange for the ransomware actors backing down.
RELATED RESOURCE
The sweet spot of modern enterprise computing
Achieve security, reliability, scalability, and sustainability with hybrid IT infrastructure
The next day, QNAP advised all users to update their devices, a day before the company made the controversial move to force-update vulnerable hardware.
The move was met with anger from corners of the QNAP community. Many users had finely tuned NAS configurations that were undone with the update and some complained they were left no more secure than before the company forced the firmware update.
Others were more aggrieved at the company’s decision to force the update in the first place, the main argument being that users should have the choice to update or not, given that it was their product.
According to Censys, the first DeadBolt campaign infected just shy of 5,000 devices and the second affected more than 1,000.

Connor Jones has been at the forefront of global cyber security news coverage for the past few years, breaking developments on major stories such as LockBit’s ransomware attack on Royal Mail International, and many others. He has also made sporadic appearances on the ITPro Podcast discussing topics from home desk setups all the way to hacking systems using prosthetic limbs. He has a master’s degree in Magazine Journalism from the University of Sheffield, and has previously written for the likes of Red Bull Esports and UNILAD tech during his career that started in 2015.
-
M&S suspends online sales as 'cyber incident' continues
News Marks & Spencer (M&S) has informed customers that all online and app sales have been suspended as the high street retailer battles a ‘cyber incident’.
By Ross Kelly
-
Manners cost nothing, unless you’re using ChatGPT
Opinion Polite users are costing OpenAI millions of dollars each year – but Ps and Qs are a small dent in what ChatGPT could cost the planet
By Ross Kelly
-
Ransomware attacks are rising — but quiet payouts could mean there's more than actually reported
News Ransomware attacks continue to climb, but they may be even higher than official figures show as companies choose to quietly pay to make such incidents go away.
By Nicole Kobie
-
Cleo attack victim list grows as Hertz confirms customer data stolen – and security experts say it won't be the last
News Hertz has confirmed it suffered a data breach as a result of the Cleo zero-day vulnerability in late 2024, with the car rental giant warning that customer data was stolen.
By Ross Kelly
-
‘Phishing kits are a force multiplier': Cheap cyber crime kits can be bought on the dark web for less than $25 – and experts warn it’s lowering the barrier of entry for amateur hackers
News Research from NordVPN shows phishing kits are now widely available on the dark web and via messaging apps like Telegram, and are often selling for less than $25.
By Emma Woollacott
-
Healthcare systems are rife with exploits — and ransomware gangs have noticed
News Nearly nine-in-ten healthcare organizations have medical devices that are vulnerable to exploits, and ransomware groups are taking notice.
By Nicole Kobie
-
Alleged LockBit developer extradited to the US
News A Russian-Israeli man has been extradited to the US amid accusations of being a key LockBit ransomware developer.
By Emma Woollacott
-
February was the worst month on record for ransomware attacks – and one threat group had a field day
News February 2025 was the worst month on record for the number of ransomware attacks, according to new research from Bitdefender.
By Emma Woollacott
-
CISA issues warning over Medusa ransomware after 300 victims from critical sectors impacted
News The Medusa ransomware as a Service operation compromised twice as many organizations at the start of 2025 compared to 2024
By Solomon Klappholz
-
Warning issued over prolific 'Ghost' ransomware group
News The Ghost ransomware group is known to act fast and exploit vulnerabilities in public-facing appliances
By Solomon Klappholz