INSUBCONTINENT EXCLUSIVE:
QNAP network-attached storage (NAS) devices are once again under attack as the operators of the eCh0raix ransomware have launched a new wave
of attacks.The eCh0raix ransomware was first deployed last July when its creators released the first version of their malware into the wild
Although its first ransomware ended up being decrypted, the group persisted and eventually deployed a new version that security researchers
were unable to crack.The eCh0raix ransomware group has also faced strong competition from IoT botnet operators as well as from other
ransomware groups also targeting QNAP NAS devices such as Muhstik and QSnatch.A recent security report from Taiwanese security researcher
Henry Huang detailed three critical vulnerabilities that impact QNAP devices and the eCh0raix group has used these to launch a new series of
attacks.As reported by BleepingComputer, the eCh0raix ransomware group has recently stepped up its operations and now a new influx of
victims are reporting encrypted NAS data on the news outlet's forum.The operators of the eCh0raix ransomware have been known to use both
exploits and brute-force attacks against their victims
The group uses exploits to target vulnerabilities in QNAP devices that have not been patched and they then use brute-force attacks to guess
users' admin passwords.Although it has yet to be confirmed, the eCh0raix group could be using the recently disclosed QNAP vulnerabilities in
their latest series of attacks
All three of these QNAP vulnerabilities are easy to exploit and automate and can also lead to the full takeover of attacked devices.If you
own a QNAP NAS device, it is highly recommended that you update your QNAP firmware as well any software that might be running on your device
QNAP device owners should also change their device password to one that is complex and unique to make it harder for the eCh0raix ransomware
operators to brute-force it
Instructions on how to patch as well as update the passwords of your QNAP devices can be found here.Via ZDNet
