QNAP NAS has lately
been targeted by eCh0raix
ransomware after a
similar attack by Deadbolt on its vulnerable devices. A new wave of
eCh0raix attacks has been confirmed after an increase in the number of
submissions to ID Ransomware.
How many devices have
been infected?
No definite numbers
as such, but reports state that only a few dozen eCh0raix samples have
been submitted. The actual number of successful attacks is likely to be
higher.
- The reason is, that
only some of the victims will use the ID Ransomware service to identify
the ransomware that encrypted their devices.
- eChOraix ransomware
has been used to encrypt Synology NAS systems since August 2021. This
time victims have only reported attacks on QNAP NAS devices.
- eChOraix, also known
as QNAPCrypt, has been hitting QNAP customers since 2019. In its security
advisory, QNAP has provided detailed
step-by-step instructions on changing the NAS password, enabling IP
Access Protection, and changing the system port number.
DeadBolt ransomware
continues to target QNAP
Recently, QNAP warned
customers to protect their systems and devices against a new campaign of attacks dropping DeadBolt
ransomware.
- Even last month, QNAP warned its users about
Deadbolt ransomware attacks on its NAS devices. The current attack
marks the fourth attack this year on the
network vendor.
- To prevent from
this, QNAP has urged customers to update their devices' QTS or QuTS
hero operating systems to the latest versions.
- Moreover, Deadbolt
also adopted a new multi-tiered
extortion scheme.
- While Most
ransomware families require victims to go through a series of
complicated steps in order to get their data back, DeadBolt has added a
web interface layer that automatically sends the decryption key to the
victim.
Stay safe
QNAP NAS devices have
been hit hard by a series of ransomware attacks, first from Deadbolt
and then from ech0raix ransomware. The users need to take optimum
measures few of which are mentioned below to prevent their systems:
- Use stronger
passwords for your administrator accounts
- Enabling IP Access
Protection to protect accounts from brute force attacks
- Avoid using default
port numbers 443 and 8080
- Disable Universal
Plug and Play (UPnP) port
- Check and update QTS
to the latest version
- Use a secure VPN –
use strong passwords and two-factor authentication, secure connections
and ports, and shut down unused and out-of-date services.