Connect with us

Hi, what are you looking for?

Hard News Hard Hitting News Source Global Political News

Cyber Security

QNAP NAS devices hit in surge of ech0raix ransomware attacks

Users of QNAP network-attached storage (NAS) devices are reporting attacks on their systems with the eCh0raix ransomware, also known as QNAPCrypt.

The threat actor behind this particular malware intensified their activity about a week before Christmas, taking control of the devices with administrator privileges.

Attack count jumps before Christmas

BleepingComputer forum users managing QNAP and Synology NAS systems have been regularly reporting eCh0raix ransomware attacks but more of them started to disclose incidents around December 20.

The jump in the number of attacks is confirmed by the ID ransomware service, where submissions started to increase on December 19 and subsided towards December 26.

Spike of ech0raix ransomware submissions on ID Ransomware service
source: ID Ransomware service

The initial infection vector remains unclear at the moment. Some users admit they were reckless and did not secure the device properly (e.g. expose it to the internet over an insecure connection); others claim a vulnerability in QNAP’s Photo Station allowed the attackers to wreak havoc.

Yes I know I am a total idiot for leaving that open to this type of hack but I didnt take any of that seriously. I always thought no-one want the little guy and I will be the first to say I was wrong!

Regardless of the attack path, it appears that the eCh0raix ransomware actor creates a user in the administrator group, which allows them to encrypt all files on the NAS system.

QNAP users – some of them using the NAS device for business purposes – reported on the BleepingComputer forum that the malware encrypted pictures and documents.

Apart from the spike in the number of attacks, what stands out in this campaign is that the actor mistyped the extension for the ransom note and used the “.TXTT” extension.

ech0raix ransomware note

While this does not prevent viewing the instructions, it may create a problem for some users, who will have to point the operating system to open the file with a specific program (e.g. Notepad) or load it in said program.

BleepingComputer has seen ech0raix ransomware demands ranging from .024 ($1,200) to .06 bitcoins ($3,000) during these recent attacks.. Some users had no backup options and had to pay the threat actor to recover their files.

ech0raix ransomware payment page

It is important to note that there is a free decryptor for files locked with an older version (before July 17th, 2019) of eCh0raix ransomware. However, there is no free solution to decrypt data locked by the latest variants of the malware (versions 1.0.5 and 1.0.6).

Attacks with eCh0raix/QNAPCrypt started in June 2019 and have been a constant threat ever since. QNAP earlier this year alerted its users of another flurry of eCh0raix attacks earlier this year, targeting devices with weak passwords.

Users should follow QNAP’s recommendations to ensure proper protection of their NAS devices and the data they store.

Source: https://www.bleepingcomputer.com/news/security/qnap-nas-devices-hit-in-surge-of-ech0raix-ransomware-attacks/

Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

You May Also Like

Cyber Security

The cybercrime group evaded remediation efforts by installing persistent backdoors and deploying “new and novel malware.” A Chinese-linked hacking group that security researchers say...

Cyber Security

Google has announced the first open-source quantum resilient FIDO2 security key implementation, which uses a unique ECC/Dilithium hybrid signature schema co-created with ETH Zurich....

Cyber Security

The administration and its private sector partners announced a slate of new initiatives on Monday aimed at protecting the nation’s school systems and their...

Cyber Security

The Colorado Department of Higher Education (CDHE) discloses a massive data breach impacting students, past students, and teachers after suffering a ransomware attack in...

Copyright © 2023 Hard News Herd Hitting in Your Face News Source | World News | Breaking News | US News | Political News Website by Top Search SEO