The QNapping of QNAP Devices
ID: 15517b1d-294e-5be1-90b5-813be5971678
STIX ID: report--15517b1d-294e-5be1-90b5-813be5971678
Feed Name: Censys Blog
Date Published: 2022-01-27
Date Updated: 2026-04-27
Author: Mark Ellzey; Senior Security Researcher
**Executive Summary:** The Censys report documents the DeadBolt ransomware campaign that infected thousands of QNAP NAS devices in January 2022, displaying ransom messages demanding Bitcoin (0.03 BTC per victim or 50 BTC for a master key); Censys observed up to ~4,988 infected services before counts decreased following QNAP forced updates, and the report provides indicators, observed BTC addresses, impact details, and mitigation recommendations.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.