#qnap

Analysis · May 20, 2026 · Colten Anderson

DeadBolt skipped the network intrusion and just encrypted the NAS directly

Most ransomware has to break in, escalate, and spread before it encrypts anything. DeadBolt found internet-exposed QNAP NAS devices, exploited a Photo Station bug, and encrypted the files in place. On a NAS, the device is the data, and that changes the whole attack.