Security Experts:

Connect with us

Hi, what are you looking for?



US, UK Warn of Malware Targeting QNAP NAS Devices

In a joint alert this week, the United States and the United Kingdom warned that a piece of malware has infected over 62,000 QNAP network-attached storage (NAS) devices.

In a joint alert this week, the United States and the United Kingdom warned that a piece of malware has infected over 62,000 QNAP network-attached storage (NAS) devices.

Dubbed QSnatch, the malware was first observed last year, and QNAP in November issued a security advisory to alert users of the risks associated with it and to provide recommendations on how they can remain protected.

At the time, the company revealed that QSnatch was designed to harvest confidential information from the compromised devices, including login credentials and system configuration.

“Due to these data breach concerns, QNAP devices that had been infected may still be vulnerable to reinfection after removing the malware,” the company said.

In their joint alert, the United States Cybersecurity and Infrastructure Security Agency (CISA) and the United Kingdom’s National Cyber Security Centre (NCSC) warn that all NAS devices from QNAP might be vulnerable to QSnatch.

“The malware, documented in open-source reports, has infected thousands of devices worldwide with a particularly high number of infections in North America and Europe. Further, once a device has been infected, attackers can prevent administrators from successfully running firmware updates,” the alert reads.

The two agencies said they identified two QSnatch campaigns, one likely running between 2014 and 2017, and another that started in late 2018 and remained active until at least late 2019, and also revealed that there were approximately 62,000 infected devices around the world as of June 2020.

Although the infrastructure used in these campaigns is no longer active, “the threat remains to unpatched devices,” CISA and NCSC say.

The malware, they note, installs a fake device admin page to steal credentials, contains an SSH backdoor to enable code execution, features a credentials scrapper and webshell functionality to enable remote access, and can exfiltrate data to the attackers’ server over HTTPS.

“The malware appears to gain persistence by preventing updates from installing on the infected QNAP device. The attacker modifies the system host’s file, redirecting core domain names used by the NAS to local out-of-date versions so updates can never be installed,” the alert reads.

To stay protected from this threat, users are advised to install the latest available security patches. Those who run vulnerable versions of the firmware are advised to perform a full factory reset before updating the firmware, to ensure that the threat is removed, the alert reads.

CISA and NCSC recommend that organizations take all the necessary measures described by QNAP in its November 2019 advisory.

Related: Vulnerabilities Exposed Hundreds of Thousands of QNAP NAS Devices to Attacks

Related: Storage Maker QNAP Warns of Malware Targeting Its NAS Devices

Related: Ransomware Targets QNAP Linux Systems

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Expert Insights

Related Content

Application Security

Cycode, a startup that provides solutions for protecting software source code, emerged from stealth mode on Tuesday with $4.6 million in seed funding.


Zendesk is informing customers about a data breach that started with an SMS phishing campaign targeting the company’s employees.


The release of OpenAI’s ChatGPT in late 2022 has demonstrated the potential of AI for both good and bad.


Websites of German airports, administration bodies and banks were hit by DDoS attacks attributed to Russian hacker group Killnet

Network Security

NSA publishes guidance to help system administrators identify and mitigate cyber risks associated with transitioning to IPv6.

CISO Strategy

Cybersecurity-related risk is a top concern, so boards need to know they have the proper oversight in place. Even as first-timers, successful CISOs make...

Management & Strategy

Industry professionals comment on the recent disruption of the Hive ransomware operation and its hacking by law enforcement.


The FBI dismantled the network of the prolific Hive ransomware gang and seized infrastructure in Los Angeles that was used for the operation.