Deadbolt

Jaarbeeld Ransomware 2025 | NCSC

Ransomware continued to cause substantial harm to Dutch organizations in 2025, with attackers encrypting systems and increasingly stealing data for double extortion; some campaigns now steal data without deploying encryption. Dutch authorities warn that backups and cyber insurance do not eliminate the operational, financial, and privacy impact, and urge victims to report every incident—including those involving ransom payments—to police. Information sharing under the public-private Project Melissa partnership provided monthly visibility into ransomware incidents affecting the Netherlands and supports investigations, potential decryption opportunities, and suspect identification. The threat remains driven primarily by preventable access failures rather than novel techniques: exploitation of unpatched vulnerabilities and compromised accounts are the leading intrusion paths. Earlier Dutch assessments recorded 178 successful ransomware attacks in 2023 affecting hundreds of organizations and millions of individuals; two-thirds of 90 examined victims lacked sufficient fundamentals such as MFA, strong password controls, timely patching, and network segmentation. Organizations should prioritize these controls, maintain tested and segregated backups, prepare and exercise incident-recovery procedures, and avoid paying ransoms, as payment neither guarantees recovery nor prevents further extortion.

Ransomware-aanvallen kunnen vaak voorkomen worden door invoering basis-beveiligingsmaatregelen | NCSC

Organisaties onvoldoende weerbaar tegen ransomware | NCSC

Melissa: samenwerkingsverband ransomwarebestrijding | NCSC

Meerderheid ransomware-slachtoffers had geen back-up | NCSC

Melissa: samenwerkingsverband ransomwarebestrijding | politie.nl

Closing the Door DeadBolt Ransomware Locks Out Vendors With Multitiered Extortion Scheme | Trend Micro (US)

DeadBolt ransomware targeted network-attached storage (NAS) devices with a highly automated campaign that locked victims out of their systems and paired encryption with a multi-tiered extortion model aimed at both end users and device vendors. The operation reportedly depended on scale rather than traditional big-game hunting, with attackers using volume and automation to compromise large numbers of internet-exposed NAS devices and demand payment for decryption. Despite reports that roughly 92% of victims did not pay, the operators still earned about US$300,000 while inflicting an estimated US$2.69 million in economic damage. Researchers said the campaign showed how ransomware actors can remain profitable even with low payment rates by combining broad targeting, operational efficiency, and pressure on multiple parties in the ecosystem, a model that could influence future ransomware activity against appliance-like devices.

New DeadBolt ransomware targets QNAP devices, asks 50 BTC for master key