Asustor NAS Security Guide: DeadBolt 2022 and the ADM Lockdown

Asustor's turn came weeks after QNAP's: in February 2022, DeadBolt encrypted Asustor NAS files with .deadbolt extensions — roughly 350 internet-connected devices at peak. Asustor shipped ADM fixes (advisory AS-2022-002) and Singapore's CSA published the response steps that still apply to any hit.

What CSA told Asustor owners in 2022 (still the right moves)

• If hit: unplug Ethernet; shut down safely (hold power 3 s); do not initialize (that erases data); contact Asustor support.
• If not hit: change default ports (8000/8001 admin, 80/443 remote); disable EZ Connect if unused; disable Terminal/SSH/SFTP; back up immediately; remove internet exposure if you don't need remote access.

Asustor lockdown today

1. ADM on the latest build (Control Center → online update).
2. Ports 8000/8001 never forwarded.
3. Snapshots on Btrfs models; MyArchive USB drives double as your offline 3-2-1 copy (a MyArchive drive unplugged from the box is exactly the offline copy ransomware can't reach).
4. Uninstall unused packages (PHP apps especially — see PHP2Shell).

Full steps: 12-step checklist. Hit? Recovery guide.

Was Asustor hit by DeadBolt as badly as QNAP?

No — peak infections were around 350 Asustor devices versus ~5,000 QNAP devices, reflecting QNAP's much larger internet-exposed base. But the attack was identical: exposed admin surface plus a flaw patched in ADM updates.

What is Asustor's best ransomware defense today?

Current ADM, no exposed 8000/8001 ports, snapshots on Btrfs models, and a MyArchive USB drive kept offline — that last one is an Asustor-specific superpower for 3-2-1 backups.