Critical QNAP NAS Zero-Day Bug Exploited to Deliver DeadBolt Ransomware

This is the fourth DeadBolt campaign this year against QNAP customers, but it differs from previous attacks in exploiting an unpatched bug instead of a known vulnerability.

A critical zero-day security vulnerability in QNAPs network-attached storage (NAS) devices has been actively exploited in the wild to deliver the DeadBolt ransomware variant.
The vendor warned that the exploitation was first spotted over the weekend, and that the campaign appears to target QNAP NAS devices running Photo Station with internet exposure. Photo Station allows users to centrally store and manage full resolution photos across devices via QNAP NAS.
QNAP is keeping the details of the bug under wraps for now, but it did recommend in
its advisory
that users disable the port forwarding function on the router to help mitigate their risk (along with applying strong passwords and performing regular data backups).
The discovery also prompted the company to push out an emergency firmware fix. The updated versions are:
QTS 5.0.1: Photo Station 6.1.2 and later
QTS 5.0.0/4.5.x: Photo Station 6.0.22 and later
QTS 4.3.6: Photo Station 5.7.18 and later
QTS 4.3.3: Photo Station 5.4.15 and later
QTS 4.2.6: Photo Station 5.2.14 and later
The DeadBolt gang has been hammering QNAP NAS hard this year; this is only the latest campaign using bugs in the system to infect devices. Previous
waves of exploitation were seen in May
using known vulnerabilities, and
twice in June
.
DeadBolt stands apart from other NAS-focused ransomware families, researchers
noted earlier this year
, because it deploys a multitiered scheme aimed at both the vendors and their victims, and offering multiple cryptocurrency payment options.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Critical QNAP NAS Zero-Day Bug Exploited to Deliver DeadBolt Ransomware