Loading story…
CISA and the UK National Cyber Security Centre warned that QSnatch malware compromised tens of thousands of QNAP network-attached storage devices, with about 62,000 infected systems identified globally in mid-2020, including roughly 7,600 in the United States and 3,900 in the United Kingdom. The malware targeted QNAP NAS appliances to steal administrator credentials, enable SSH backdoor and webshell access, exfiltrate files, and block firmware updates by altering host file entries, leaving affected devices exposed even after administrators attempted remediation.
Technical analysis showed QSnatch used at least two domain generation algorithm (DGA) variants to locate command-and-control infrastructure and retrieve additional malicious code. One variant generated up to 2,610 algorithmic domains across 145 TLDs using multiple time intervals, while a second simpler variant used 30 TLDs and a 15-day interval; both derived domains from the seed string IbjGOEgnuD through a SHA-1 and Base64-based process. Authorities said the more recent campaign began in late 2018 and remained active into late 2019, and advised defenders to run QNAP Malware Remover, perform a full factory reset, update firmware, and limit external exposure of NAS devices.
See affected versions and whether adversaries are exploiting it.
11 events from the most recent confirmed update back to the earliest known activity.
CISA and NCSC reported approximately 62,000 QSnatch-infected devices worldwide in mid-June 2020, including about 7,600 in the United States and 3,900 in the United Kingdom. They said infections were especially concentrated in North America and Europe.
Finland's National Cyber Security Centre published an article about QSnatch in late October 2019, bringing public attention to the malware targeting QNAP NAS devices. The bin.re analysis explicitly cites this publicity milestone.
Samples associated with QSnatch were present on VirusTotal by at least June 2019. This indicates the malware was circulating publicly months before broader government publicity.
A Version A QSnatch sample with SHA256 9526ccdeb9bf7cfd9b34d290bdb49ab6a6acefc17bff0e85d9ebb46cca8b9dc2 had a version timestamp of 2019-05-17 05:00 UTC. The same sample was later described as the one currently delivered in November 2019.
A Version A QSnatch sample with SHA256 3c38e7bb004b000bd90ad94446437096f46140292a138bfc9f7e44dc136bac8d had a version timestamp of 2019-03-20 05:00 UTC. This provides evidence of QSnatch activity and code versioning by that date.
CISA and NCSC reported that the second QSnatch campaign was still active in late 2019. Their alert also noted attackers used QSnatch against QNAP NAS devices during that period.
CISA and NCSC reported that a second QSnatch campaign began in late 2018. This later campaign was still active in late 2019 and became the focus of subsequent public reporting.
The first QSnatch campaign identified by CISA and NCSC continued until mid-2017. The agencies distinguished it from a later campaign that started afterward.
CISA and the UK National Cyber Security Centre identified an initial QSnatch campaign targeting QNAP NAS devices that likely began in early 2014. This earlier campaign continued until mid-2017 and differed from the later campaign in initial payloads and some capabilities.
CISA and the UK National Cyber Security Centre published a joint alert warning of legacy risk from QSnatch malware targeting QNAP NAS devices. The alert described two campaigns, detailed the malware's capabilities, and advised organizations to reset, update, and restrict access to affected devices.
A reverse-engineering analysis identified seven QSnatch samples using two different domain generation algorithms, labeled Version A and Version B. The research documented how the malware generated algorithmic domains for command-and-control communications.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 55 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
QNAP warned that its NAS devices are being hit by the **AgeLocker** ransomware operation and urged customers to immediately update the **QTS** operating system and installed applications. The company also advised administrators not to expose NAS systems directly to the internet, recommending remote access only through a trusted VPN or **myQNAPcloud** link. QNAP did not specify which vulnerabilities were being exploited, leaving open whether attackers were abusing older unpatched flaws in QTS and **PhotoStation** or a more recently fixed issue. AgeLocker was first documented as a targeted ransomware strain that encrypts files with the open-source **Age** utility rather than a custom cryptographic routine, a technique identified by the `age-encryption.org` header in encrypted files. Researchers reported that the malware appended victim-specific extensions to filenames and, in at least one case, skipped an on-system ransom note in favor of an emailed "security audit" demand seeking **7 bitcoin** while offering to decrypt a small number of files as proof. The campaign added to a broader wave of ransomware activity affecting QNAP devices, alongside earlier **Qlocker** and **eCh0raix** incidents.
Aug 14, 2026
QNAP has patched 14 vulnerabilities across **QTS**, **QuTS hero**, **QuTS cloud**, and **QVP** that affect NAS and surveillance appliances, with impacts ranging from denial of service and information disclosure to privilege escalation and remote code execution. The vendor’s advisory `QSA-26-10` describes multiple bug classes, including command injection, buffer overflow, broken access control, URL injection, NULL pointer dereference, and uncontrolled resource consumption, and rates the issues as **Important**. The most serious flaws include command injection vulnerabilities `CVE-2025-66273`, `CVE-2025-66279`, and `CVE-2026-22893`, which can allow arbitrary command execution through username handling or administrative APIs, including one privilege-escalation scenario. QNAP also fixed `CVE-2025-59382`, a password-reset URL manipulation issue that can expose credentials. Fixed releases include **QVP 2.8.0**, **QuTS cloud C5.2.9**, **QTS 5.2.9.3499**, and **QuTS hero h5.2.9**; administrators were urged to update immediately, avoid exposing management interfaces to the internet, and maintain snapshots and offline backups because internet-facing NAS devices are frequent ransomware targets.
Jun 29, 2026
QNAP has released security updates to address seven zero-day vulnerabilities in its network-attached storage (NAS) products after these flaws were exploited by security researchers during the Pwn2Own Ireland 2025 competition. The vulnerabilities affected QNAP's QTS and QuTS hero operating systems, as well as key applications including Hyper Data Protector, Malware Remover, and HBS 3 Hybrid Backup Sync. The exploits were demonstrated by teams such as Summoning Team, DEVCORE, Team DDOS, and a CyCraft technology intern, highlighting the critical nature of these security issues. QNAP has provided patched versions for all affected software and strongly recommends that users update to the latest releases and change all passwords to enhance security. The company has published detailed advisories and instructions for updating both the operating systems and vulnerable applications through the QTS or QuTS hero interface. Regular updates and monitoring of product support status are advised to ensure ongoing protection against similar vulnerabilities.
Jun 29, 2026