Tracking Deadbolt Ransomware Across the Globe

Deadbolt ransomware has resurfaced for a third wave targeting QNAP QTS NAS devices: instead of full-device encryption it encrypts backup directories and alters the web admin interface, enabling easy internet-wide detection. Censys and partners track infected hosts and Bitcoin addresses, reporting around 469 infected devices as of May 20 and providing dashboards and transaction analysis to monitor infections and ransom payments.