Walden Systems Geeks Corner News Malware Targets QNAP NAS Rutherford NJ New Jersey NYC New York City North Bergen County

Malware Targets QNAP NAS

Rita gives you full control of what sites your employees visit. Rita can block sites that eat up your precious bandwidth such as media streaming sites. Rita enables you full control of what sites your employees can and cannot visit. Rita gives you the ability to block undesirable sites by wildcard or by name. Rita gives you the ability to determine which computers will be blocked and which will be allowed. With Rita, you can block access to sensitive servers within your LAN.

The UK and US governments issued joint alert about a strain of malware targeting network attached storage (NAS) devices from QNAP. The QSnatch malware had infected 62,000 devices worldwide, including 3900 in the UK and 7600 in the US, according to the notice from the Department of Homeland Security's Cybersecurity and Infrastructure Security Agency. This is the result of two campaigns, one running from 2014 to mid-2017 and the other starting in late 2018.

Even though the identities and objectives of the hackers using QSnatch are unknown, the malware is sophisticated, and the chackers demonstrate an awareness of operational security. QSnatch appears to be injected into the device firmware during the infection stage, with the malicious code subsequently run within the device, compromising it. The hacker then uses a domain generation algorithm to establish a command and control channel that periodically generates multiple domain names for use in C2 communications.

QSnatch apparently features a credential scraper, SSH backdoor, CGI password logger, webshell functionality and the ability to steal a predetermined list of files, including system configs and log files. It achieves persistence by modifying the system host's file to redirect domain names to out-of-date versions in order to prevent updates from installing on the NAS device itself.

The NCSC/CISA urged administrators to follow the guidance issued by QNAP last November. Once a device has been infected, hackers make it impossible for administrators to successfully run the needed firmware updates. This makes it extremely important for organizations to ensure their devices have not been previously compromised. Organizations still running a vulnerable version must run a full factory reset on the device prior to completing the firmware upgrade to ensure the device is not left vulnerable.