Loading story…
QNAP warned that eCh0raix ransomware is actively targeting its NAS devices, with intrusions linked to weak passwords and the active exploitation of a zero-day in Roon Labs' Roon Server versions 2021-02-01 and earlier running on QNAP systems. The company urged customers to disable the vulnerable Roon Server app, avoid exposing NAS devices directly to the Internet, and strengthen authentication, while also disclosing a patched command-injection flaw in its Malware Remover app that could enable remote command execution.
Security researchers previously described eCh0raix as a Go-based ransomware family aimed at QNAP NAS appliances, encrypting files with AES, appending the .encrypt extension, and dropping a README_FOR_DECRYPT.txt ransom note. Analysis indicated the operators likely gained access by brute-forcing credentials and exploiting known flaws, and that the malware communicated with a Tor-hidden command-and-control service through a SOCKS5 proxy at 192.99.206[.]61:65000; researchers also noted implementation weaknesses in its key generation that suggested a decryptor might be feasible.
See which actors are running it and whether you're in range.
8 events from the most recent confirmed update back to the earliest known activity.
A separate campaign in September 2020 targeted publicly exposed QNAP NAS devices by exploiting vulnerable Photo Station versions.
QNAP said its NAS devices were again targeted by eCh0raix ransomware in June 2020, showing the campaign's recurrence against the platform.
QNAP NAS devices were targeted by the eCh0raix ransomware campaign in June 2019. Anomali also reported observing the new ransomware family targeting QNAP devices, likely via weak credentials and known vulnerabilities.
QNAP said it fixed a command injection vulnerability in its Malware Remover app that could allow remote attackers to execute arbitrary commands on vulnerable devices.
QNAP published a security advisory warning that eCh0raix ransomware was affecting its NAS devices and that an actively exploited zero-day in Roon Server 2021-02-01 and earlier was being used on QNAP NAS systems. The company urged stronger passwords, brute-force protections, and disabling Roon Server until a patch became available.
QNAP customers were hit by AgeLocker ransomware two weeks before QNAP's later warning about eCh0raix and the Roon Server zero-day.
QNAP removed a backdoor account with hardcoded credentials from its HBS 3 Hybrid Backup Sync app. It was later confirmed that Qlocker operators used this account to compromise some NAS devices and encrypt files.
A large Qlocker ransomware campaign began targeting QNAP devices in mid-April. QNAP later confirmed some compromises used a hardcoded backdoor account in the HBS 3 Hybrid Backup Sync app.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 13 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
QNAP warned that its NAS devices are being hit by the **AgeLocker** ransomware operation and urged customers to immediately update the **QTS** operating system and installed applications. The company also advised administrators not to expose NAS systems directly to the internet, recommending remote access only through a trusted VPN or **myQNAPcloud** link. QNAP did not specify which vulnerabilities were being exploited, leaving open whether attackers were abusing older unpatched flaws in QTS and **PhotoStation** or a more recently fixed issue. AgeLocker was first documented as a targeted ransomware strain that encrypts files with the open-source **Age** utility rather than a custom cryptographic routine, a technique identified by the `age-encryption.org` header in encrypted files. Researchers reported that the malware appended victim-specific extensions to filenames and, in at least one case, skipped an on-system ransom note in favor of an emailed "security audit" demand seeking **7 bitcoin** while offering to decrypt a small number of files as proof. The campaign added to a broader wave of ransomware activity affecting QNAP devices, alongside earlier **Qlocker** and **eCh0raix** incidents.
Aug 14, 2026
CISA and the UK National Cyber Security Centre warned that **QSnatch** malware compromised tens of thousands of QNAP network-attached storage devices, with about **62,000 infected systems** identified globally in mid-2020, including roughly **7,600 in the United States** and **3,900 in the United Kingdom**. The malware targeted QNAP NAS appliances to steal administrator credentials, enable **SSH backdoor** and **webshell** access, exfiltrate files, and block firmware updates by altering host file entries, leaving affected devices exposed even after administrators attempted remediation. Technical analysis showed QSnatch used at least **two domain generation algorithm (DGA) variants** to locate command-and-control infrastructure and retrieve additional malicious code. One variant generated up to **2,610 algorithmic domains** across **145 TLDs** using multiple time intervals, while a second simpler variant used **30 TLDs** and a 15-day interval; both derived domains from the seed string `IbjGOEgnuD` through a SHA-1 and Base64-based process. Authorities said the more recent campaign began in late 2018 and remained active into late 2019, and advised defenders to run QNAP Malware Remover, perform a full factory reset, update firmware, and limit external exposure of NAS devices.
Aug 15, 2026
QNAP has patched 14 vulnerabilities across **QTS**, **QuTS hero**, **QuTS cloud**, and **QVP** that affect NAS and surveillance appliances, with impacts ranging from denial of service and information disclosure to privilege escalation and remote code execution. The vendor’s advisory `QSA-26-10` describes multiple bug classes, including command injection, buffer overflow, broken access control, URL injection, NULL pointer dereference, and uncontrolled resource consumption, and rates the issues as **Important**. The most serious flaws include command injection vulnerabilities `CVE-2025-66273`, `CVE-2025-66279`, and `CVE-2026-22893`, which can allow arbitrary command execution through username handling or administrative APIs, including one privilege-escalation scenario. QNAP also fixed `CVE-2025-59382`, a password-reset URL manipulation issue that can expose credentials. Fixed releases include **QVP 2.8.0**, **QuTS cloud C5.2.9**, **QTS 5.2.9.3499**, and **QuTS hero h5.2.9**; administrators were urged to update immediately, avoid exposing management interfaces to the internet, and maintain snapshots and offline backups because internet-facing NAS devices are frequent ransomware targets.
Jun 29, 2026