QNAP Network Attached Storage (NAS) devices, manufactured by the Taiwanese corporation QNAP Systems, Inc. have been facing cyber threats from various groups, such as the Muhstik and the QSnatch groups. Recently, a new variant of any already known ransomware was seen again, actively attacking QNAP NAS devices.
The eCh0raix wave targeting QNAP NAS
- In June 2020, the eCh0raix ransomware operators launched a new wave of attacks targeting the QNAP network-attached storage (NAS) devices.
- The ransomware operators likely incorporated exploits for the three vulnerabilities (CVE-2019-7192, CVE-2019-7194, and CVE-2019-7195) that were recently discovered in mid-May 2020.
- The eCh0raix gang uses two different attack vectors: exploitation of known vulnerabilities in unpatched QNAP devices, and brute force attacks to break admin passwords.