Dutch police trick DeadBolt ransomware gang

DeadBolt is a ransomware gang that appeared in January 2022, targeting Qnap network storage servers and Asustor devices. It asks for a ransom of 0.03 bitcoin (about 600 euros) to unlock data and has reportedly claimed over 20,000 victims worldwide.

Dutch police and cybersecurity firm Responders found that the group automated the creation of a BitCoin transaction containing the decryption key as soon as the ransom was paid.

So, they waited for a bottleneck in the BitCoin blockchain to initiate transactions, which were cancelled in the process before they had time to be permanently recorded in the blockchain. The operation fooled DeadBolt’s automation, which delivered a total of 155 decryption keys.

Responders made these keys available to potential victims of the ransomware gang. For its part, DeadBolt finally realized the scheme and set up a double confirmation mechanism before sending the decryption keys.