Getty Images

Emsisoft releases DeadBolt ransomware decryption tool

Emsisoft's DeadBolt ransomware decryption tool fixes broken decryptor keys issued by threat actors, and works only if the victim has paid the ransom and received a key.

A decryption key is now available for DeadBolt ransomware only a few days after the strain first appeared. The catch, however, is that it requires a decryption key provided by threat actors to work.

The key, released Friday by security vendor Emsisoft, arrives only a few days after the DeadBolt ransomware gang began targeting the customers of QNAP network-attached storage (NAS) devices. Customers affected by the ransomware were told to pay 0.03 bitcoin (approximately $1,150 USD as of this writing) to have their files decrypted.

The ransom note that victims received also included a note for Taiwanese hardware vendor QNAP. According to the note, DeadBolt exploited a zero-day vulnerability that enabled the gang to attack vulnerable QNAP NAS devices exposed to the internet. QNAP was then told to pay 5 bitcoin for vulnerability details or 50 bitcoin for vulnerability details and a mass decryption key.

Whether this decryption tool would have even worked remains in question, as a user on the QNAP NAS community forums claimed to have paid the ransom and received an invalid key. In addition, Emsisoft CTO Fabian Wosar tweeted that a firmware update by QNAP is the cause of decryption issues.

Emsisoft's decryption tool allows customers who paid the ransom to implement their decryption key correctly.

DeadBolt ransom note from the QNAP NAS  Community Forum
QNAP NAS Community Forum

Emsisoft threat analyst Brett Callow said that due to DeadBolt's encryption, the only data recovery option for victims (other than resetting the device and applying a backup) is to pay the ransomware gang.

"DeadBolt's encryption seems to be secure, meaning the only way for victims to recover the data is to pay the ransom. Our decryptor is designed to help those who do pay," Callow said. "QNAP's forced update removes the ransomware payload and, without that, the decryptor supplied by the criminals will not work. Our decryptor addresses that problem."

QNAP published a blog last Wednesday with instructions for customers to protect their vulnerable devices.

QNAP has not responded to SearchSecurity's request for comment at press time.

Alexander Culafi is a writer, journalist and podcaster based in Boston.

Dig Deeper on Threats and vulnerabilities

Enterprise Desktop
Cloud Computing