New eCh0raix Ransomware Variant Targets QNAP and Synology Network-Attached Storage Devices
Summary: Unit 42 researchers found a new eCh0raix ransomware variant that targets both QNAP and Synology NAS devices, the first time the malware combines functionality for both vendors, and attackers are using CVE-2021-28799 to deliver it to QNAP devices. The first sample of the combined variant dates to September 2020, and a June 21 attack exploited the QNAP Hybrid Backup Sync vulnerability using a hard-coded session ID to fetch malware from a remote server.
Why it matters: Roughly 250,000 QNAP and Synology NAS devices are exposed to the public internet, and SOHO users without dedicated security staff can be used as a stepping stone into supply chain attacks on large enterprises.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2021-28799
- Related
- CVE-2021-28799: QNAP NAS Improper Authorization Vulnerability Known Exploited Vulnerabilities · Mar 31, 2022