Taiwanese network-attached storage (NAS) appliance manufacturer QNAP Systems has revealed that a vulnerability in its Hybrid Backup Sync software has been exploited in Qlocker ransomware attacks.
Last month, the maker of NAS devices and professional network video recorder (NVR) solutions warned of QNAP NAS devices being targeted by two ransomware families known as Qlocker and eCh0raix, advising users to download and install its Malware Remover tool to identify infections.
In an advisory published on Friday, the company revealed that the attackers have leveraged an improper authorization vulnerability in Hybrid Backup Sync (HBS) 3 for initial access.
“A ransomware campaign targeting QNAP NAS began the week of April 19th, 2021. The ransomware known as Qlocker exploits CVE-2021-28799 to attack QNAP NAS running certain versions of HBS 3 (Hybrid Backup Sync),” QNAP said.
The manufacturer explained that, on the infected NAS devices, the ransomware creates password-protected 7z archives and moves users’ files into them, after which it deploys a ransom note into each affected folder. Users are instructed to contact the attackers to receive the password necessary for restoring their data.
The targeted vulnerability was addressed in late April with the release of HBS 3 v16.0.0415 (for QTS 4.5.2), HBS 3 v3.0.210412 (for QTS 4.3.6), HBS 3 v3.0.210411 (for QTS 4.3.3 and 4.3.4), and HBS 3 v16.0.0419 (for QuTS hero h4.5.1 and QuTScloud c4.5.1~c4.5.4). HBS 2 and HBS 1.3 are not vulnerable.
“To prevent infection from Qlocker, we recommend updating HBS 3 to the latest version,” QNAP notes.
Last week, the NAS manufacturer said it was investigating reports of new malicious attacks targeting its devices, as well as continuous assaults involving the eCh0raix ransomware.
Related: Exploit Released for Critical Vulnerability Affecting QNAP NAS Devices
Related: Unpatched RCE Flaws Affect Tens of Thousands of QNAP SOHO NAS Devices
Related: QNAP Urges Users to Secure Devices Against Brute-Force Attacks