Taiwanese network-attached storage (NAS) appliance manufacturer QNAP Systems has revealed that a vulnerability in its Hybrid Backup Sync software has been exploited in Qlocker ransomware attacks.
Last month, the maker of NAS devices and professional network video recorder (NVR) solutions warned of QNAP NAS devices being targeted by two ransomware families known as Qlocker and eCh0raix, advising users to download and install its Malware Remover tool to identify infections.
In an advisory published on Friday, the company revealed that the attackers have leveraged an improper authorization vulnerability in Hybrid Backup Sync (HBS) 3 for initial access.
“A ransomware campaign targeting QNAP NAS began the week of April 19th, 2021. The ransomware known as Qlocker exploits CVE-2021-28799 to attack QNAP NAS running certain versions of HBS 3 (Hybrid Backup Sync),” QNAP said.
The manufacturer explained that, on the infected NAS devices, the ransomware creates password-protected 7z archives and moves users’ files into them, after which it deploys a ransom note into each affected folder. Users are instructed to contact the attackers to receive the password necessary for restoring their data.
The targeted vulnerability was addressed in late April with the release of HBS 3 v16.0.0415 (for QTS 4.5.2), HBS 3 v3.0.210412 (for QTS 4.3.6), HBS 3 v3.0.210411 (for QTS 4.3.3 and 4.3.4), and HBS 3 v16.0.0419 (for QuTS hero h4.5.1 and QuTScloud c4.5.1~c4.5.4). HBS 2 and HBS 1.3 are not vulnerable.
“To prevent infection from Qlocker, we recommend updating HBS 3 to the latest version,” QNAP notes.
Last week, the NAS manufacturer said it was investigating reports of new malicious attacks targeting its devices, as well as continuous assaults involving the eCh0raix ransomware.
Related: Exploit Released for Critical Vulnerability Affecting QNAP NAS Devices
Related: Unpatched RCE Flaws Affect Tens of Thousands of QNAP SOHO NAS Devices
Related: QNAP Urges Users to Secure Devices Against Brute-Force Attacks

More from Ionut Arghire
- OpenAI Patches Account Takeover Vulnerabilities in ChatGPT
- New Wi-Fi Attack Allows Traffic Interception, Security Bypass
- Casino Giant Crown Resorts Investigating Ransomware Group’s Data Theft Claims
- Over 200 Organizations Targeted in Chinese Cyberespionage Campaign
- Nigerian BEC Scammer Sentenced to Prison in US
- China’s Nuclear Energy Sector Targeted in Cyberespionage Campaign
- 14 Million Records Stolen in Data Breach at Latitude Financial Services
- iOS Security Update Patches Exploited Vulnerability in Older iPhones
Latest News
- Musk, Scientists Call for Halt to AI Race Sparked by ChatGPT
- Malware Hunters Spot Supply Chain Attack Hitting 3CX Desktop App
- LeapXpert Banks $22M Funding to Secure Corporate Messaging With Consumer Apps
- Blockchain Security Firm True I/O Raises $9 Million
- Spera Banks $10 Million to Tackle Identity and Access Sprawl
- OpenAI Patches Account Takeover Vulnerabilities in ChatGPT
- OpenSSL 1.1.1 Nears End of Life: Security Updates Only Until September 2023
- New Wi-Fi Attack Allows Traffic Interception, Security Bypass
