Loading story…
DeadBolt ransomware targeted network-attached storage (NAS) devices with a highly automated campaign that locked victims out of their systems and paired encryption with a multi-tiered extortion model aimed at both end users and device vendors. The operation reportedly depended on scale rather than traditional big-game hunting, with attackers using volume and automation to compromise large numbers of internet-exposed NAS devices and demand payment for decryption.
Despite reports that roughly 92% of victims did not pay, the operators still earned about US$300,000 while inflicting an estimated US$2.69 million in economic damage. Researchers said the campaign showed how ransomware actors can remain profitable even with low payment rates by combining broad targeting, operational efficiency, and pressure on multiple parties in the ecosystem, a model that could influence future ransomware activity against appliance-like devices.
TTPs, infrastructure, and targeting history in one profile.
2 events from the most recent confirmed update back to the earliest known activity.
Trend Micro Research authored YARA rules named deadbolt_cgi_ransomnote and deadbolt_uncompressed for detecting DeadBolt artifacts. The rules are identified in the content as having been authored in March 2022.
DeadBolt ransomware began targeting QNAP NAS devices exposed to the internet, encrypting files, appending the .deadbolt extension, and replacing the normal login page with a ransom screen demanding 0.03 BTC. The attackers also claimed to possess a zero-day vulnerability and offered QNAP vulnerability details or a universal master key for sale.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 11 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
trendmicro.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft reported that the **DeadLock** ransomware operation has emerged as a financially motivated threat using **double extortion** and a decentralized recovery ecosystem designed to resist disruption. First observed in July 2025, DeadLock had listed **more than 80 claimed victims** by July 2026, with over half in Europe, and has affected organizations across multiple sectors and regions. Microsoft said the malware has been deployed by multiple groups, including an affiliate tied to the **Lynx** and **INC** ransomware ecosystems. The Rust-based encryptor combines common ransomware tradecraft with an unusual communications and leak infrastructure. Microsoft said DeadLock attempts privilege escalation, terminates services and processes, clears event logs, selectively encrypts files, drops ransom notes, and self-deletes, while its recovery workflow relies on a local HTML chat app, the **Session** messaging network, **Polygon** smart contracts for configuration and blog data, and **Wasabi**-hosted stolen files exposed through an S3-compatible browser. The company also described DeadLock's hybrid cryptography using `Curve25519` and `XChaCha20` with per-file ephemeral keys, assessing the scheme as cryptographically sound and leaving no practical decryption path without the attackers' private key.
Aug 18, 2026
**CryptoLocker** emerged as a highly disruptive ransomware operation that encrypted files with strong public-key cryptography, including data on local drives, removable media, and accessible network shares, then demanded roughly **$300/€300** in **Bitcoin** or MoneyPak for the private key. Victims were warned they had only about **72 hours** to pay before losing access permanently, and reports indicated that the malware’s encryption was generally not breakable, leaving organizations and consumers dependent on payment or unaffected backups. Security reporting also noted that some victims who paid did receive working decryption keys, while disruptions to command-and-control infrastructure sometimes prevented even paying victims from recovering files. The operators later added a **"second chance"** decryption portal that raised the price from **2 bitcoins** during the initial deadline to **10 bitcoins** after expiration, effectively turning the campaign into a more structured extortion service. Coverage linked the operation to the use of **Tor** and resilient backend infrastructure to conceal command systems and maintain contact with victims, while later reporting traced **millions of dollars in laundered Bitcoin** tied to the crimewave. The campaign underscored how ransomware actors were combining strong encryption, anonymous payment channels, and hidden services to industrialize file-encryption extortion at scale.
Jun 29, 2026
**Reveton** ransomware spread through drive-by downloads, compromised websites, malvertising, spam, fake software downloads, and secondary delivery by existing botnets, while posing as law-enforcement agencies such as the FBI to demand fraudulent fines for alleged child pornography or piracy violations. Reporting on the operation said the malware was frequently delivered via exploit kits including **BlackHole**, often alongside the **Citadel** banking Trojan, and that some variants also stole stored passwords in addition to locking victims' systems. The campaign relied on a broader criminal ecosystem built to maximize infections and evade disruption, including traffers, redirectors, reverse proxies, traffic direction systems, fake websites, domain rotation, fast-flux hosting, DGAs, crypting services, AV-check services, and underground advertising platforms. Researchers and law enforcement described the scheme as highly profitable, generating tens of thousands of euros per day across multiple countries, and warned that remediation often required full system reinstallation because the visible ransomware screen could mask additional malware on the infected host.
Aug 15, 2026