QSnatch Malware Infects Thousands of NAS Devices, Steals Credentials

mood · Oct 31, 2019

QSnatch Malware Infects Thousands of NAS Devices, Steals Credentials
October 31, 2019
https://www.bleepingcomputer.com/ne...-thousands-of-nas-devices-steals-credentials/

Thousands of QNAP NAS devices are getting infected with a malware dubbed QSnatch that injects into their firmware and proceeds to steal credentials and load malicious code retrieved from its command and control (C2) servers.
Germany's Computer Emergency Response Team (CERT-Bund) says that, based on sinkhole data, roughly 7,000 NAS devices in Germany are currently affected by QSnatch infections.

The malware received the QSnatch name based on the devices it targets and the information "snatching" activity detailed below.

It is nice to close a busy week at @CERTFI (NCSC-FI) with a new malware discovery: #Qsnatch targets #QNAP #NAS devices. Here the NCSC-FI #Autoreporter service played a critical part on anomaly discovery - together with our sharp malware specialists. https://t.co/43nyfUKWu3
— Kauto Huopio (@kautoh) October 25, 2019
Infection and malicious activity
While the infection vector is not yet known, the researchers found that QSnatch will get injected into the firmware of QNAP NAS devices during the infection stage, with the malicious code being "run as part of normal operations within the device."
Click to expand...

QSnatch - Malware designed for QNAP NAS devices

mood · Nov 7, 2019

QNAP Warns Users to Secure Devices Against QSnatch Malware
November 7, 2019
https://www.bleepingcomputer.com/ne...rs-to-secure-devices-against-qsnatch-malware/

Network-attached storage (NAS) maker QNAP urges customers to secure their NAS devices against an ongoing malicious campaign that infects them with QSnatch malware capable of stealing user credentials.

Malware Remover 3.5.4.0 and 4.5.4.0 versions are now capable of removing QSnatch after new rules were added by the company updated it on November 1.

"Users are urged to install the latest version of the Malware Remover app from QTS App Center or by manual downloading from the QNAP website," says QNAP.
"Users are advised to take actions listed in the security advisory or, alternatively, contact QNAP for technical assistance. Instructions for creating a support request can be found here."
The company also provides detailed step-by-step procedures on how to change device passwords, to enable IP and account access protection, to disable SSH and Telnet connections, and to change the system port number.
Click to expand...

mood · Jul 27, 2020

UK and US warn QNAP owners to upgrade firmware to block malware
July 27, 2020
https://www.bleepingcomputer.com/ne...-owners-to-upgrade-firmware-to-block-malware/

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the UK's National Cyber Security Centre (NCSC) today issued an alert about the risks of infection faced by QNAP NAS devices if QSnatch malware attacks restart.

Although the attack infrastructure used in previous QSnatch attacks (from early 2014 to mid-2017 and from late 2018 to late 2019) is currently not active, the two agencies urge all QNAP customers to update their NAS devices as soon as possible to block future campaigns.
62,000 QNAP devices infected worldwide

"All QNAP NAS devices are potentially vulnerable to QSnatch malware if not updated with the latest security fixes," the two agencies explain (1, 2).
"Organizations that are still running a vulnerable version must run a full factory reset on the device prior to completing the firmware upgrade to ensure the device is not left vulnerable," the joint alert warns.
Click to expand...

QNAP warned its customers of ongoing attacks trying to infect their NAS devices with QSnatch malware in November 2019 after security researchers at the National Cyber Security Centre of Finland (NCSC-FI) discovered thousands of infected QNAP NAS devices.
While the infection vector is still unknown (with the exception of the fact that QSnatch is injected into the device firmware), the agencies mention that some of the samples found on infected NAS devices will "intentionally patch the infected QNAP for Samba remote code execution vulnerability CVE-2017-7494."

This is either part of an attempt to block others from taking control of the devices after they ger infected with QSnatch or is a sign of a potential infection vector used in previous attacks to deploy the malware.
Click to expand...

mood · Jul 31, 2020

QNAP urges users to update Malware Remover after QSnatch alert
July 31, 2020
https://www.bleepingcomputer.com/ne...o-update-malware-remover-after-qsnatch-alert/

QNAP urges its users to update the Malware Remover app and bolster their NAS devices' security following a QSnatch malware joint alert published earlier this week by UK's NCSC and the US CISA government cybersecurity agencies.

While QNAP made it a point out of asking customers to reinforce their devices' security, the Taiwanese vendor also contradicted reports mentioning an increase in the number of NAS devices infected since October 2019.

"Certain media reports claiming that the affected device count has increased from 7,000 to 62,000 since October 2019 are inaccurate due to a misinterpretation of reports from different authorities," QNAP said.
Click to expand...

Users urged to secure QNAP devices
Right now, the attack infrastructure behind the previous QSnatch attacks is down, but users are urged by both QNAP and the two agencies to update their NAS devices as soon as possible to block future attacks.

"Users are urged to install the latest version of the Malware Remover app from the QTS App Center or by manual downloading from the QNAP website," QNAP said today. "QNAP also recommends a series of actions for enhancing QNAP NAS security."
Click to expand...

QNAP: Response to QSnatch Attacks: No Malware Variants Found and Affected User Count Reducing

QNAP® Systems, Inc. (QNAP) today issued a statement in response to recent reports (link 1 2) and media coverage indicating that the QSnatch malware is targeting QNAP NAS and attempting to obtain access.

QNAP has updated its Malware Remover application for the QTS operating system on November 1, 2019 to detect and remove the malware from QNAP NAS and has also released an updated security advisory on November 2, 2019 to address the issue. Subsequently, QNAP has taken multiple actions (summarized as follows) to assist our users in defending data security:
Click to expand...

mood · Aug 8, 2020

Taiwan’s QNAP Denies Storage Equipment Infections Are Rising
“Certain media reports claiming that the affected device count has increased from 7,000 to 62,000 since October 2019 are inaccurate”
August 7, 2020
https://www.cbronline.com/news/taiwans-qnap-denies-storage-equipment-infections-are-rising

Taiwanese storage software and hardware vendor QNAP says there is no sign that infections of its products are growing, after over 60,000 of its network attached storage (NAS) devices were reported to be infected with malware by an unknown attacker.

Over 3,900 QNAP NAS boxes have been compromised in the UK and an alarming 28,000-plus in Western Europe, the NCSC warned July 27 in a joint advisory with the US’s CISA.
QNAP has since suggested the figures have been misrepresented as a steady surge in infections from initial reports in late 2019 and says the issue is contained. (Carnegie Mellon, Thomson Reuters, Florida Tech, the Government of Iceland were among those notified of infection by security researchers early in the campaign).
Click to expand...

As Computer Business Review has reported, QNAP initially flagged the threat in November 2019 and pushed out guidance at the time, but the NCSC said too many devices remain infected: the initial infection vector remains deeply opaque, as do the motives of the attackers, whose publicly known C&C infrastructure is dormant.
Non-profit watchdog ShadowServer also reported similar numbers around the same time.
Click to expand...

Log in or Sign up

QSnatch Malware Infects Thousands of NAS Devices, Steals Credentials

mood Updates Team

mood Updates Team

mood Updates Team

mood Updates Team

mood Updates Team

Log in or Sign up

QSnatch Malware Infects Thousands of NAS Devices, Steals Credentials

mood Updates Team

mood Updates Team

mood Updates Team

mood Updates Team

mood Updates Team

Useful Searches