QNAP NAS has lately been targeted by eCh0raix ransomware after a similar attack by Deadbolt on its vulnerable devices. A new wave of eCh0raix attacks has been confirmed after an increase in the number of submissions to ID Ransomware.
How many devices have been infected?
No definite numbers as such, but reports state that only a few dozen eCh0raix samples have been submitted. The actual number of successful attacks is likely to be higher.
- The reason is, that only some of the victims will use the ID Ransomware service to identify the ransomware that encrypted their devices.
- eChOraix ransomware has been used to encrypt Synology NAS systems since August 2021. This time victims have only reported attacks on QNAP NAS devices.
- eChOraix, also known as QNAPCrypt, has been hitting QNAP customers since 2019. In its security advisory, QNAP has provided detailed step-by-step instructions on changing the NAS password, enabling IP Access Protection, and changing the system port number.
DeadBolt ransomware continues to target QNAP
Recently, QNAP warned customers to protect their systems and devices against a new campaign of attacks dropping DeadBolt ransomware.
- Even last month, QNAP warned its users about Deadbolt ransomware attacks on its NAS devices. The current attack marks the fourth attack this year on the network vendor.
- To prevent from this, QNAP has urged customers to update their devices' QTS or QuTS hero operating systems to the latest versions.
- Moreover, Deadbolt also adopted a new multi-tiered extortion scheme.
- While Most ransomware families require victims to go through a series of complicated steps in order to get their data back, DeadBolt has added a web interface layer that automatically sends the decryption key to the victim.
Stay safe
QNAP NAS devices have been hit hard by a series of ransomware attacks, first from Deadbolt and then from ech0raix ransomware. The users need to take optimum measures few of which are mentioned below to prevent their systems:
- Use stronger passwords for your administrator accounts
- Enabling IP Access Protection to protect accounts from brute force attacks
- Avoid using default port numbers 443 and 8080
- Disable Universal Plug and Play (UPnP) port
- Check and update QTS to the latest version
- Use a secure VPN – use strong passwords and two-factor authentication, secure connections and ports, and shut down unused and out-of-date services.
Publisher
/https://cyware-ent.s3.amazonaws.com/image_bank/shutterstock_395220817.jpg)
/https://cyware-ent.s3.amazonaws.com/image_bank/2963_shutterstock_1037670889.jpg)
