PSA Qnap ransomware attacks going on since 4/19/21

MetalizeYourBrain · April 22, 2021, 9:57am

Hi, I wanted to report on this news that’s been hitting my news feed since today and that I feel might interest many people here that are using a Qnap NAS at the moment:

tl;dr The cryptolocker Qlocker is moving all the victims files to .7zip password protected archives and asking for 0.01BTC ransom to decrypt the files. Seems like a vulnerability in the cryptolocker has been found to recover for free the crypted data. Stay tuned.

Feel free to add more links regarding this news update.

I decided to create a thread because I feel this news needs to reach as much users as possible. If it’s not deemed worthy of a thread I’ll move this to the news story dump thread. Thanks.

regulareel · April 22, 2021, 10:09am

I think there were recent reports of QNAP vulnerability and QNAP refuses to fix them (as heard from Security now podcast) This was the source of the news:

Looks like hackers arent wasting any opportunity to make money off ransomware.

MetalizeYourBrain · April 22, 2021, 10:18am

I guess attacking a NAS can net even more profit than attacking a PC since they’re usually used to store data and backups long term.
Qnap is also terrible for not addressing such a gigantic vulnerability, since it has been found and it’s out in the open.
But also the article I posted talks about two vulnerabilities being fixed not that long ago, but I don’t know if those are the same you linked.

Trooper_ish · April 23, 2021, 8:25am

Patched now?

Qnap nas file locker ransomeware, patch now Security

I know there are a few out there on here, get your patches. It is a file scrambling ransomeware. Advice from Qnap Install the latest software updates for the Multimedia Console, Media Streaming Add-on, and Hybrid Backup Sync apps on their QNAP NAS gear to close off vulnerabilities that can be exploited by ransomware to infect devices. Install the latest Malware Remover tool from QNAP, and run a malware scan. The manufacturer said it has “released an updated version of Malware Remover for operating systems such as QTS and QuTS hero to address the ransomware attack.” Change the network port of the web-based user interface away from the default of 8080, presumably to mitigate future attacks. We’ll assume for now that vulnerable devices are being found and attacked by miscreants scanning the internet for public-facing QNAP products – we’ve asked the manufacturer to comment on this. Make sure they use strong, unique passwords that can’t easily be brute-forced or guessed. If possible, follow the 3-2-1 rule on backups: have at least three good recent copies of your documents stored on at least two types of media, at least one of which is off-site. That means if your files are scrambled, you have a good chance of restoring them from a backup untouched by the malware, thus avoiding having to cough up the demand, if you make sure the software nasty can’t alter said backups. If user data is encrypted or being encrypted, the NAS must not be shut down. Users should run a malware scan with the latest Malware Remover version immediately, and then contact QNAP Technical Support at service.qnap.com.

MetalizeYourBrain · April 23, 2021, 5:49pm

Looks like they fixed it, yeah.