Taiwanese network hardware and software provider QNAP has directed their customers to upgrade to the latest version of Photo Station to patch a critical zero-day vulnerability affecting their network-attached storage (NAS) devices. The flaw is being actively exploited to download DeadBolt ransomware on vulnerable NAS devices that are accessible from the public internet. Not much is known at this time about the specifics of the vulnerability, likely to allow as many customers as possible to patch their devices before making the exploit public. The surge was observed by QNAP’s Product Security Incident Response Team (QNAP PSIRT) on September 3 and 4, 2022, and they were impressively able to release a working patch within twelve (12) hours. Along with patching their NAS firmware, QNAP advises their customers to disable automatic port forwarding and block device access to the public internet. QNAP also recommends enabling their VPN service or utilizing the myQNAPcloud Link feature for remote access services, which allows the devices to be accessible via the internet exclusively through the myQNAPcloud website. Alternatively, QNAP has suggested switching from Photo Station to a more secure photo management tool called QuMagie. Although this flaw has been patched, DeadBolt ransomware campaigns have been targeting NAS devices since January 2022. As a best practice, CTIX analysts recommend that administrators do not allow their NAS devices to be public facing, create strong passwords for all user accounts, and create regular backups. This vulnerability will be monitored, and an update to this matter may be published in the near future.