A critical zero-day security vulnerability in QNAP's network-attached storage (NAS) devices has been actively exploited in the wild to deliver the DeadBolt ransomware variant.

The vendor warned that the exploitation was first spotted over the weekend, and that "the campaign appears to target QNAP NAS devices running Photo Station with internet exposure." Photo Station allows users to centrally store and manage full resolution photos across devices via QNAP NAS.

QNAP is keeping the details of the bug under wraps for now, but it did recommend in its advisory that users disable the port forwarding function on the router to help mitigate their risk (along with applying strong passwords and performing regular data backups).

The discovery also prompted the company to push out an emergency firmware fix. The updated versions are:

The DeadBolt gang has been hammering QNAP NAS hard this year; this is only the latest campaign using bugs in the system to infect devices. Previous waves of exploitation were seen in May using known vulnerabilities, and twice in June.

DeadBolt stands apart from other NAS-focused ransomware families, researchers noted earlier this year, because it deploys a multitiered scheme aimed at both the vendors and their victims, and offering multiple cryptocurrency payment options.