Deadbolt ransomware

DeadBolt is ransomware that has hit internet-facing QNAP and ASUSTOR NAS devices since 25 January 2022. It encrypts files with AES-128 and adds .deadbolt to their names. Instead of dropping notes, it replaces the NAS login page with a ransom screen that asks 0.03 BTC to a Bitcoin address unique to each device. After payment the key comes back inside a transaction to that same address and is typed into the screen. The operators also offered the vendors the claimed zero-day details for 5 BTC, or a master key for every victim for 50 BTC. Emsisoft publishes a free DeadBolt decryptor for Windows, but it still needs the victim's own key and mainly helps when a firmware update has removed the ransom page. In October 2022 the Dutch police and Responders.NU obtained 155 keys by making ransom payments and cancelling them before they were confirmed. DeadBolt does not steal data and has no leak site.

File extensions: deadbolt

Decryptor: A decryptor exists but covers only some builds. Checked 2026-10-13.

Data exfiltration risk: Undocumented