DeadBolt Ransomware Hits Asustor NAS Devices

In a move that has left IT experts scratching their heads, hackers have released an encryption tool called DeadBolt which targets NAS devices. As it turns out, the ransomware doesn’t kill your files; instead it simply encrypts them and demands ransom to decrypt them. Experts say this is merely just part of the latest trend in cyber-crime: criminals are now targeting small businesses with cheap storage solutions because they’re easier to hack into than larger enterprises.

The “asustor ransomware” is a new strain of ransomware that has been targeting Asustor NAS devices. This malware encrypts the files on the device and then demands payment to decrypt them. The ransom amount is $500 worth of Bitcoin.

DeadBolt-Ransomware-Hits-Asustor-NAS-Devices Image credit: Asustor

According to increasing posts on reddit and the company’s own community forum from users who were surprised to find that all of their files had been encrypted, the dreaded DeadBolt ransomware has now begun proliferating on NAS units manufactured by Asustor, following earlier coverage relating to QNAP devices. Owners of Asustor NAS systems have been warned to unplug their devices from the internet immediately, lest they lose file access and get a ransom letter demanding.03 BTC (about $1,140 at the time of this publication) to unlock their material. Some DeadBolt victims mistakenly sent their encrypted data to services like OneDrive and Google Drive, so users may wish to desynchronize from cloud services as well.

DeadBolt-Ransomware-Hits-Asustor-NAS-Devices ramfu ramfu ramfu ramfu ramf

Megathread – Ransomware Attack (r/asustor)

The myasustor.com DDNS service will be stopped until the problem is examined in response to Deadbolt ransomware threats impacting ASUSTOR devices. As we examine and analyze the reasons to ensure this does not happen again, ASUSTOR will share further information as fresh developments become available. We will continue to assist impacted clients in any manner we can. For your safety, we suggest the following precautions:
- Change default ports, such as NAS web access ports 8000 and 8001 and remote web access ports 80 and 443.
- EZ Connect should be turned off.
- Make a backup right away.
- Terminal/SSH and SFTP services should be turned off.

ASUStor NAS (Tom’s Hardware) is the target of a Deadbolt ransomware attack.

DeadBolt has been attacking unprotected NAS systems linked to the Internet for quite some time. The same virus already wrecked havoc on QNAP devices, and Asustor seems to be the next victim.
The criminals are demanding 0.03 bitcoin, which is worth roughly $1,154 at today’s market rate. It’s the same amount requested by the hijackers from their QNAP victims. Surprisingly, the gang made no proposals to Asustor. For five bitcoins ($184,000), the gang offered to share the vulnerability data with QNAP, or sell it the universal decryption master key for 50 bitcoins ($1.85 million).
It’s unclear if all Asustor NAS devices are vulnerable to the DeadBolt attack, however user input suggests that certain models, such as the AS6602T, AS-6210T-4K, AS5304T, AS6102T, or AS5304T, are not. Meanwhile, the AS5304T, AS6404T, AS5104T, and AS7004T are among the types impacted.