QNAP NAS Security Guide: Qlocker, DeadBolt, eCh0raix — History and Current Posture

No vendor has absorbed more NAS ransomware than QNAP — and every campaign followed the identical recipe: exposed admin interface + a flaw QNAP had already patched. QNAP's installed base (80,000+ internet-exposed services during DeadBolt) makes it a permanent scanner target.

Incident history

• 2019–2021 — eCh0raix: first NAS-native ransomware family; hit QNAP hard, later added Synology targeting.
• April 2021 — Qlocker: packed victims' files into password-protected 7z archives via a QTS flaw; thousands affected in days.
• Jan–May 2022 — DeadBolt (3 waves): exploited flaw QSA-21-57 (patched 12 days before the first wave hit); .deadbolt extension; hijacked the login page with the ransom note; ~5,000 infections at peak; demanded 0.03 BTC per victim and even offered a "master key" ransom to QNAP itself (which Trend Micro showed couldn't work). Third wave targeted EOL QTS 4.3.6/4.4.1 in May.

QNAP-specific lockdown

1. Update QTS/QuTS hero — and get off EOL 4.3.x/4.4.x branches (DeadBolt's third wave fed on exactly those).
2. No forwarded 8080/443. Use myQNAPcloud Link (relay) or VPN.
3. Malware Remover on + current; Hybrid Backup Sync with the built-in 3-2-1 job wizard.
4. Snapshots on (Storage & Snapshots app) — QNAP's ZFS-based models have excellent snapshot protection.

Full steps: 12-step checklist. Hit already? Recovery guide.

Is QNAP still getting hit by ransomware in 2026?

The current active campaign (C3RB3R, October 2026) targets Synology, not QNAP. But QNAP remains the most-hit vendor historically, and its large exposed install base keeps it attractive. The posture advice is identical: latest QTS, no exposed admin, snapshots, off-box backup.

What did DeadBolt teach QNAP owners?

That 'patched by the vendor' means nothing until you install it — DeadBolt's first wave exploited a flaw fixed 12 days earlier, and the third wave specifically hunted end-of-life QTS 4.3.x/4.4.1 devices. Update discipline is the lesson.