QNAP network-attached storage (NAS) devices are once again under attack as the operators of the eCh0raix ransomware have launched a new wave of attacks.The eCh0raix ransomware was first deployed last July when its creators released the first version of their malware into the wild.
Although its first ransomware ended up being decrypted, the group persisted and eventually deployed a new version that security researchers were unable to crack.The eCh0raix ransomware group has also faced strong competition from IoT botnet operators as well as from other ransomware groups also targeting QNAP NAS devices such as Muhstik and QSnatch.A recent security report from Taiwanese security researcher Henry Huang detailed three critical vulnerabilities that impact QNAP devices and the eCh0raix group has used these to launch a new series of attacks.As reported by BleepingComputer, the eCh0raix ransomware group has recently stepped up its operations and now a new influx of victims are reporting encrypted NAS data on the news outlet's forum.The operators of the eCh0raix ransomware have been known to use both exploits and brute-force attacks against their victims.
The group uses exploits to target vulnerabilities in QNAP devices that have not been patched and they then use brute-force attacks to guess users' admin passwords.Although it has yet to be confirmed, the eCh0raix group could be using the recently disclosed QNAP vulnerabilities in their latest series of attacks.
All three of these QNAP vulnerabilities are easy to exploit and automate and can also lead to the full takeover of attacked devices.If you own a QNAP NAS device, it is highly recommended that you update your QNAP firmware as well any software that might be running on your device.
QNAP device owners should also change their device password to one that is complex and unique to make it harder for the eCh0raix ransomware operators to brute-force it.
Instructions on how to patch as well as update the passwords of your QNAP devices can be found here.Via ZDNet