Deadbolt ransomware decryption: unlock your data

Group-IB’s report analyzes DeadBolt, a Go-based ransomware family that has been actively targeting NAS devices (QNAP, ASUSTOR) since January 2022 by exploiting NAS software vulnerabilities; it encrypts files (appending .deadbolt), replaces NAS web interfaces with ransom pages, demands ~0.03–0.05 BTC from victims and 10–50 BTC from vendors, and uses AES-128-CBC with embedded configuration and metadata to manage per-victim keys and decryption via the device web UI and OP_RETURN blockchain transaction data.