New Deadbolt Ransomware Targeting Small Businesses

29th March 2022 | Blog

Secure your business with CyberHoot Today!!!

In January 2021, reports emerged of a backup-targeting ransomware strain called Deadbolt aimed at small businesses, hobbyists, and serious home users. As far as we can see, Deadbolt deliberately chose a deadly niche in which to operate: users who needed backups and were well-informed enough to make them, but who didn’t have the time or funds to give their backup routine the attention it deserves.

Many ransomware attacks develop with cybercriminals breaking into your network, mapping out all your computers, scrambling all the files on all of them, and then presenting a blackmail demand along the lines of, “Pay us $ and we’ll send you a decryption key to unlock everything.” Which has unfortunately been very successful for hackers attacking larger organizations. But what Deadbolt does is very different.

Deadbolt Ransomware

Deadbolt ignores the computers on your network and attacks vulnerable Network-Attached Storage (NAS) devices directly over the Internet. By exploiting a security vulnerability in QNAP products, the Deadbolt malware doesn’t need to get a foothold on your devices and spread laterally through the network. A Remote Code Execution (RCE) gap identified in QNAP’s security advisory QSA-21-57 back in Jan. of 2021 can be exploited to inject malicious code directly onto the storage device itself.

So, if you’d inadvertently set up your backup device so that its web portal was accessible from the “internet side” of your network connection – the port that’s probably labeled WAN on your router, short for wide-area network – then anyone who knew how to abuse the security hole patched in QSA-21-57 could attack your backup files with malware.

In fact, if you were in the habit of looking at your device only when you needed to recover or review files you didn’t have space to keep “live” on your laptop, you might not have realized that your files had been scrambled until you next went to the web interface of your NAS.

When you got there, however, you’d be in no doubt at all what had happened to your data, because the Deadbolt attackers deliberately modified the portal page of the NAS itself to confront you with the grim news:

What Does This Mean For My Organization?

The good news in the Deadbolt story is that QNAP not only published a patch for the QSA-21-57 vulnerability back in January 2021 but also went on to take the step of automatically pushing out that update even to devices with automatic updating turned off. [Editors note: How does a company override the settings we make in our QNAP device? Is that a security risk in and of itself?]

The bad news is that the Internet security scanning service Censys is reporting that Deadbolt infections have suddenly made their way back onto its radar, with more than 1000 affected devices showing up in late March 2022; even with the patches applied.

What Should You Do?

It’s vital organizations practice their Business Continuity and Disaster Recovery (BCDR) plans, using tabletop exercises to practice a backup scenario. Many victims see themselves having to rebuild their data in a way they didn’t predict. That’s why tabletop exercises are especially important. CyberHoot recommends creating an entire BCDR Plan so you know your Recovery Point Objective and your Recovery Time Objective. CyberHoot also recommends the 3-2-1 backup method, which means 3 copies of our data should be kept (one primary, two backups), where files are saved on 2 types of media and 1 copy is stored off-site (this can be online). Testing your BCDR plan at least annually will help you eliminate many of the above mistakes that businesses commonly make.

You should also not open your network servers up to the Internet. QNAP has advice on how to prevent your NAS device from receiving connections from the public Internet by mistake, thus preventing your device from being accessed or even discovered in the first place. Perform a similar check for all the IoT devices on your network, just in case you have private devices that can inadvertently be connected to the Internet.

Additional Cybersecurity Recommendations

Additionally, these recommendations below will help you and your business stay secure with the various threats you may face on a day-to-day basis. All of the suggestions listed below can be gained by hiring CyberHoot’s vCISO Program development services.

Govern employees with policies and procedures. You need a password policy, an acceptable use policy, an information handling policy, and a written information security program (WISP) at a minimum.
Train employees on how to spot and avoid phishing attacks. Adopt a Learning Management system like CyberHoot to teach employees the skills they need to be more confident, productive, and secure.
Test employees with Phishing attacks to practice. CyberHoot’s Phish testing allows businesses to test employees with believable phishing attacks and put those that fail into remedial phish training.
Deploy critical cybersecurity technology including two-factor authentication on all critical accounts. Enable email SPAM filtering, validate backups, deploy DNS protection, antivirus, and anti-malware on all your endpoints.
In the modern Work-from-Home era, make sure you’re managing personal devices connecting to your network by validating their security (patching, antivirus, DNS protections, etc) or prohibiting their use entirely.
If you haven’t had a risk assessment by a 3rd party in the last 2 years, you should have one now. Establishing a risk management framework in your organization is critical to addressing your most egregious risks with your finite time and money.
Buy Cyber-Insurance to protect you in a catastrophic failure situation. Cyber-Insurance is no different than Car, Fire, Flood, or Life insurance. It’s there when you need it most.

All of these recommendations are built into CyberHoot the product or CyberHoot’s vCISO Services. With CyberHoot you can govern, train, assess, and test your employees. Visit CyberHoot.com and sign up for our services today. At the very least continue to learn by enrolling in our monthly Cybersecurity newsletters to stay on top of current cybersecurity updates.