{"id":22749,"date":"2021-12-28T11:30:56","date_gmt":"2021-12-28T10:30:56","guid":{"rendered":"http:\/\/159.69.82.204\/win\/?p=22749"},"modified":"2021-12-31T10:07:01","modified_gmt":"2021-12-31T09:07:01","slug":"ransomware-ech0raix-greift-qnap-gerte-an-12-2021","status":"publish","type":"post","link":"https:\/\/borncity.com\/win\/2021\/12\/28\/ransomware-ech0raix-greift-qnap-gerte-an-12-2021\/","title":{"rendered":"Ransomware eCh0raix attacks QNAP devices (Dez. 2021)"},"content":{"rendered":"

\"Sicherheit[German<\/a>]Owners of QNAP NAS drives that are accessible via the Internet were attacked by the eCh0raix ransomware in a new campaign around Christmas. There are only a few people affected, but this malware, also known as QNAPCrypt, encrypts the devices and extorts a ransom. The ransomware is not new either, as I had warned about attacks in June 2020 (see QNAP Security Advisory about eCh0raix Ransomware<\/a>).<\/p>\n

Besitzer von QNAP-NAS-Laufwerken, die per Internet erreichbar sind, wurden rund um Weihnachten in einer neuen Kampagne von der eCh0raix-Ransomware angegriffen. Es sind zwar nur wenige Betroffene, aber diese auch als QNAPCrypt bekannte Schadsoftware verschl\u00fcsselt die Ger\u00e4te und erpresst L\u00f6segeld. Neu ist die Ransomware auch nicht, hatte ich doch im Juni 2020 vor Angriffen gewarnt (siehe QNAP Sicherheitswarnung vor eCh0raix-Ransomware<\/a>).<\/p>\n

<\/p>\n

The eCh0raix ransomware<\/h2>\n

\"\"It's a never-ending story. In July 2019, I had warned about a ransomware called eChoraix in the article Ransomware addressing QNAP-\/Synology NAS systems<\/a>. The malware uses brute force attacks on the web interfaces of these devices to compromise installations that may have been secured with weak passwords. If successful, all files on the NAS are encrypted and the ransomware drops a notice that the user may pay a ransom to get their data back. <\/p>\n

eCh0raix ransomware attacks on Christmas 2021<\/h2>\n

The colleagues at Bleeping Computer report in this recent article<\/a> that around a week before Christmas, increased attacks on QNAP devices by the threat actors of eCh0raix ransomware were observed. The colleagues probably noticed hints in their own forum<\/a> from affected people.  <\/p>\n

\"eCh0raix
eCh0raix attacks on ONAP, Source: ID Ransomware service<\/a><\/p>\n

The graph above shows an increase just before Christmas, and now a decrease again, although the peak was still below 100 infections (quite a small value). How the attackers proceed is currently unclear – at Bleeping Computer, some people suspect an attack via QNAP Photo Station. The article still contains some hints, but no real details. Anyone from the readership affected?<\/p>\n

\n

Spinsafe has published this article<\/a>, which also links to a decrypter that can recover files encrypted with older malware versions.<\/p>\n<\/blockquote>\n

Similar articles
<\/strong>QNAP Security Advisory about eCh0raix Ransomware<\/a>
Security Alert for Synology DiskStation Manager and UC SkyNAS<\/a>
Fix for critical helpdesk vulnerability in QNAP NAS devices (Oct. 7, 2020)<\/a>
AgeLocker Ransomware attacks QNAP NAS drives<\/a>
Ransomware addressing QNAP-\/Synology NAS systems<\/a>
QNAP Security Advisory about eCh0raix Ransomware<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

[German]Owners of QNAP NAS drives that are accessible via the Internet were attacked by the eCh0raix ransomware in a new campaign around Christmas. There are only a few people affected, but this malware, also known as QNAPCrypt, encrypts the devices … Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[580],"tags":[69],"class_list":["post-22749","post","type-post","status-publish","format-standard","hentry","category-security","tag-security"],"_links":{"self":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts\/22749","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/comments?post=22749"}],"version-history":[{"count":0,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts\/22749\/revisions"}],"wp:attachment":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/media?parent=22749"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/categories?post=22749"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/tags?post=22749"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}