Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Cybercrime

QNAP Investigating New Attacks Targeting NAS Devices

Network-attached storage (NAS) appliance manufacturer QNAP Systems says it is investigating reports of malicious attacks targeting NAS devices.

Network-attached storage (NAS) appliance manufacturer QNAP Systems says it is investigating reports of malicious attacks targeting NAS devices.

Known worldwide for its NAS and professional network video recorder (NVR) solutions, the Taiwan-based company on Friday issued two advisories to warn of a new wave of attacks targeting its users, urging them to ensure that their NAS devices are not exposed to the Internet.

In the first advisory, the company reveals it is investigating an attack campaign in which threat actors target a vulnerability in the Roon Server. The company says all QNAP NAS devices that run Roon Server 2021-02-01 and earlier might be susceptible to attacks.

Provided by Roon Labs, the Roon Server provides QNAP NAS users with the full range of capabilities they would expect from a music server, including an easy way to navigate music and access to artist biography, concert dates, lyrics, and more.

“We have already notified Roon Labs of the issue and are thoroughly investigating the case. We will release security updates and provide further information as soon as possible,” QNAP says.

In the meantime, users should make sure their NAS is not connected to the Internet and should also disable the Roon Server to ensure they are not exposed to potential attacks.

Secondly, QNAP says it’s investigating reports that NAS devices continue to be targeted with the eCh0raix ransomware.

“Devices using weak passwords may be susceptible to attack. We strongly recommend users act immediately to protect their data,” the company says.

Advertisement. Scroll to continue reading.

To mitigate risks, users are advised to use strong passwords for their administrator accounts, to enable IP Access Protection to ensure accounts are protected from brute force attacks, and to avoid using default port numbers 443 and 8080.

This is not the first time QNAP NAS devices have been targeted with the eCh0raix ransomware. In April, the company warned of assaults involving the Qlocker and eCh0raix ransomware families, urging users to immediately perform detection and cleanup operations.

Related: Files on QNAP NAS Devices Encrypted in Qlocker Ransomware Attacks

Related: Exploit Released for Critical Vulnerability Affecting QNAP NAS Devices

Related: QNAP Warns NAS Users of ‘dovecat’ Malware Attacks

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Discover strategies for vendor selection, integration to minimize redundancies, and maximizing ROI from your cybersecurity investments. Gain actionable insights to ensure your stack is ready for tomorrow’s challenges.

Register

Dive into critical topics such as incident response, threat intelligence, and attack surface management. Learn how to align cyber resilience plans with business objectives to reduce potential impacts and secure your organization in an ever-evolving threat landscape.

Register

People on the Move

The City of Phoenix has promoted Mitch Kohlbecker to the role of Chief Information Security Officer.

Gigamon has promoted Tony Jarjoura to CFO and Ram Bhide has been hired as Senior VP of engineering.

Cloud security firm Mitiga has appointed Charlie Thomas as Chief Executive Officer.

More People On The Move

Expert Insights

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest cybersecurity news, threats, and expert insights. Unsubscribe at any time.