Security Experts:

Connect with us

Hi, what are you looking for?


Malware & Threats

QNAP Says Recently Patched Flaw Exploited in Qlocker Ransomware Attacks

Taiwanese network-attached storage (NAS) appliance manufacturer QNAP Systems has revealed that a vulnerability in its Hybrid Backup Sync software has been exploited in Qlocker ransomware attacks.

Taiwanese network-attached storage (NAS) appliance manufacturer QNAP Systems has revealed that a vulnerability in its Hybrid Backup Sync software has been exploited in Qlocker ransomware attacks.

Last month, the maker of NAS devices and professional network video recorder (NVR) solutions warned of QNAP NAS devices being targeted by two ransomware families known as Qlocker and eCh0raix, advising users to download and install its Malware Remover tool to identify infections.

In an advisory published on Friday, the company revealed that the attackers have leveraged an improper authorization vulnerability in Hybrid Backup Sync (HBS) 3 for initial access.

“A ransomware campaign targeting QNAP NAS began the week of April 19th, 2021. The ransomware known as Qlocker exploits CVE-2021-28799 to attack QNAP NAS running certain versions of HBS 3 (Hybrid Backup Sync),” QNAP said.

The manufacturer explained that, on the infected NAS devices, the ransomware creates password-protected 7z archives and moves users’ files into them, after which it deploys a ransom note into each affected folder. Users are instructed to contact the attackers to receive the password necessary for restoring their data.

The targeted vulnerability was addressed in late April with the release of HBS 3 v16.0.0415 (for QTS 4.5.2), HBS 3 v3.0.210412 (for QTS 4.3.6), HBS 3 v3.0.210411 (for QTS 4.3.3 and 4.3.4), and HBS 3 v16.0.0419 (for QuTS hero h4.5.1 and QuTScloud c4.5.1~c4.5.4). HBS 2 and HBS 1.3 are not vulnerable.

“To prevent infection from Qlocker, we recommend updating HBS 3 to the latest version,” QNAP notes.

Last week, the NAS manufacturer said it was investigating reports of new malicious attacks targeting its devices, as well as continuous assaults involving the eCh0raix ransomware.

Related: Exploit Released for Critical Vulnerability Affecting QNAP NAS Devices

Related: Unpatched RCE Flaws Affect Tens of Thousands of QNAP SOHO NAS Devices

Related: QNAP Urges Users to Secure Devices Against Brute-Force Attacks

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join this webinar to learn best practices that organizations can use to improve both their resilience to new threats and their response times to incidents.


Join this live webinar as we explore the potential security threats that can arise when third parties are granted access to a sensitive data or systems.


Expert Insights

Related Content


Satellite TV giant Dish Network confirmed that a recent outage was the result of a cyberattack and admitted that data was stolen.


Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...


The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.


No one combatting cybercrime knows everything, but everyone in the battle has some intelligence to contribute to the larger knowledge base.

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...


A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...


Apple has released updates for macOS, iOS and Safari and they all include a WebKit patch for a zero-day vulnerability tracked as CVE-2023-23529.

Application Security

Drupal released updates that resolve four vulnerabilities in Drupal core and three plugins.