⚠ 2019 → 2026Updated 2026-10-31
NAS Ransomware History: eCh0raix, Qlocker, DeadBolt, C3RB3R — Same Playbook Every Time
NAS ransomware feels like breaking news every time. It isn't — it's the same script running on a new vendor. Seven years of campaigns, one lesson.
| Year | Name | Targets | How it got in | Signature |
|---|---|---|---|---|
| 2019–2021 | eCh0raix | QNAP, later Synology | Exposed interfaces + weak credentials | Early NAS-specific ransomware; still collected ransoms as late as June 2021 |
| 2021 | Qlocker | QNAP | QTS flaw | Packed files into password-protected 7z archives; thousands of victims in days |
| 2022 Jan–May | DeadBolt | QNAP, then Asustor, then TerraMaster | Vendor flaws (QNAP QSA-21-57; TerraMaster CVE-2022-24990/24989 chain) | .deadbolt extension, hijacked login page with ransom note; novel "vendor ransom" scheme; ~5,000+ QNAP and ~350 Asustor infections at peak; three waves against QNAP by May |
| 2026 Oct | C3RB3R | Synology | DSM flaws: CVE-2026-13639/13684 (per Qihoo 360) or CVE-2024-10441 (per Synology) — both patched before the wave | .L0CK3D extension, read-me3.txt, ChaCha8+RSA-2048, ~$3,000 demand; encrypts the system partition too; Korea KISA + Macau PJ warnings |
The pattern that never changes
- Find the vendor's internet-facing admin surface (Censys counted 83,000+ exposed QNAP services during DeadBolt; Synology has the same exposure class today).
- Wait for or find a flaw — then attack after the patch ships, because most devices never update (DeadBolt exploited a flaw QNAP had patched 12 days earlier; C3RB3R used flaws patched 6 weeks earlier — or 2 years earlier, per Synology's statement).
- Encrypt everything reachable — including mounted USB drives and sometimes the OS partition itself.
- Collect — modest sums ($250–$3,000) optimized for home users paying "cheap" relative to their photos.
What it means for you
The defense writes itself: no exposed admin + update discipline + snapshots + one off-box backup. Every victim in every campaign above was missing at least two of those four. If you run a different vendor and feel safe reading this — Asustor and TerraMaster owners felt safe watching QNAP get hit in January 2022, and were hit in February. Your vendor's history (or lack of it) is on their page: Synology · QNAP · Asustor · TerraMaster · UGREEN · UniFi · fnOS · Zspace · TieNiu.
FAQ
Which NAS brand is safest from ransomware?
None is intrinsically safe; all mass campaigns combined an exposed admin interface with an unpatched flaw. Brands without a campaign history (UGREEN, UniFi, the Chinese brands) simply have smaller installed bases — smaller target, not stronger walls. Posture beats brand: the hardening checklist is the same 12 steps everywhere.
Did DeadBolt and C3RB3R use zero-days?
No. DeadBolt exploited flaws QNAP had already patched; C3RB3R used flaws Synology patched in September 2026 (or December 2024, per Synology's own statement). These are 1-day attacks on unpatched, internet-exposed devices — which is why updating is step one of every defense.
Are NAS ransomware attacks still active?
C3RB3R activity was still being reported through late October 2026, and officials in Korea and Macau issued warnings. If you run an unpatched, exposed Synology, treat it as active now.