NAS Ransomware File Extensions — Every Known Family, Note, and Decryptor Status

One table answers "what encrypted my NAS?" — match the file extension and ransom-note name, then follow the link for recovery odds. Decryptor status is stated honestly: most current families have no free decryptor, and that's exactly why backups decide outcomes.

Extension / sign	Family	Ransom note	Targets	Encryption	Ransom	Free decryptor?
.L0CK3D / .LOCK3D	C3RB3R (Cerber variant)	read-me3.txt → Tor site	Synology (from Oct 2026)	ChaCha8 per-file + RSA-2048 keys	~0.037 BTC (~$3,000), doubles in 4–5 days	No (as of 2026-10-31). Memory forensics (c3rb3r-rescue) recovered one victim's data
.deadbolt + hijacked login page	DeadBolt	login page itself becomes the note	QNAP (3 waves, Jan–May 2022), Asustor, TerraMaster	AES, per-victim	0.03 BTC (~$1,100) per victim; fake "vendor master key" offer (Trend Micro proved it couldn't work)	No — snapshots/backups only
Files re-packed into password-protected .7z	Qlocker	note inside archive	QNAP (April 2021)	7-Zip packing, not crypto	~$550	No public one — low ransom, volume play
.encrypt	eCh0raix (QNAPCrypt)	README_FOR_DECRYPT.txt (old) / .txtt (new)	QNAP 2019→, Synology 2020→	AES + RSA	0.024–0.06 BTC	2019 pre-July-17 variant only (community tools, e.g. BloodDolly's). Newer variants: no

Reading the table like an engineer

• "7z packing" vs real crypto: Qlocker's cleverness was that it didn't encrypt at all — it archived your files with a password. Any tool that could recover the password would unlock everything; none was released publicly, and the campaign ended before that mattered.
• Per-file keys = no master key, ever. C3RB3R's ChaCha8+RSA-2048 scheme generates a unique key per file and wraps them with the attacker's public key. Even paying only buys your keys — and DeadBolt proved "vendor master key" offers can be technically fake.
• Ransoms are priced like gym memberships — $500–$3,000, deliberately payable, doubling timers for urgency. That's a business optimized for home users with photos, not enterprises.

Not sure which one you have?

Upload nothing to anyone. Compare the note filename and extension against the table, check the vendor and year, and start with the recovery guide. If a "recovery company" promises decryption of C3RB3R/DeadBolt for a fee, know that some have been caught just paying the ransom and pocketing the difference — the honest tool inventory is short on purpose.

Is there a decryptor for .L0CK3D files?

No confirmed free decryptor for C3RB3R as of 31 October 2026. The realistic paths are snapshots, off-NAS backups, cloud-sync version history, or memory forensics with the open-source c3rb3r-rescue method — which recovered a 49 GB backup but requires the machine not to have been rebooted.

Can I just rename .L0CK3D files back?

No — the extension is a label; the file contents are encrypted with ChaCha8. Renaming changes nothing about recoverability. Keep the files (they're not dangerous once the attacker is out) in case a decryptor appears later.

Which NAS ransomware has actually been decrypted for free?

Only the eCh0raix variant active before 17 July 2019 — community brute-force decryptors (e.g. BloodDolly's) work on files marked README_FOR_DECRYPT.txt. Newer eCh0raix (.txtt), DeadBolt, Qlocker and C3RB3R have no public decryptor. This is why backup posture, not decryptor hope, is the strategy.