Loading story…
QNAP warned that its NAS devices are being hit by the AgeLocker ransomware operation and urged customers to immediately update the QTS operating system and installed applications. The company also advised administrators not to expose NAS systems directly to the internet, recommending remote access only through a trusted VPN or myQNAPcloud link. QNAP did not specify which vulnerabilities were being exploited, leaving open whether attackers were abusing older unpatched flaws in QTS and PhotoStation or a more recently fixed issue.
AgeLocker was first documented as a targeted ransomware strain that encrypts files with the open-source Age utility rather than a custom cryptographic routine, a technique identified by the age-encryption.org header in encrypted files. Researchers reported that the malware appended victim-specific extensions to filenames and, in at least one case, skipped an on-system ransom note in favor of an emailed "security audit" demand seeking 7 bitcoin while offering to decrypt a small number of files as proof. The campaign added to a broader wave of ransomware activity affecting QNAP devices, alongside earlier Qlocker and eCh0raix incidents.
TTPs, infrastructure, and targeting history in one profile.
4 events from the most recent confirmed update back to the earliest known activity.
QNAP warned about AgeLocker attacks in September 2020 as customer incidents began to rise. The ransomware had previously exploited bugs in QNAP's QTS firmware and the preinstalled PhotoStation application.
In a reported incident covered in July 2020, investigators found AgeLocker-encrypted files containing an "age-encryption.org" header and observed that the attackers emailed a ransom demand instead of leaving a ransom note on the compromised systems. The victim said the attackers demanded 7 bitcoins and offered free decryption of up to five small files as proof.
AgeLocker was first spotted in July 2020 as a new targeted ransomware strain. Reporting described it as using the Age encryption utility to encrypt victim files rather than a custom encryption implementation.
QNAP said its NAS devices were under attack by the AgeLocker ransomware operation and urged customers to immediately update QTS and installed applications. The company also advised customers not to expose NAS devices directly to the internet and to use a trusted VPN or myQNAPcloud link for remote access if needed.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
QNAP warned that **eCh0raix** ransomware is actively targeting its NAS devices, with intrusions linked to **weak passwords** and the active exploitation of a **zero-day** in **Roon Labs' Roon Server** versions `2021-02-01` and earlier running on QNAP systems. The company urged customers to disable the vulnerable Roon Server app, avoid exposing NAS devices directly to the Internet, and strengthen authentication, while also disclosing a patched command-injection flaw in its **Malware Remover** app that could enable remote command execution. Security researchers previously described eCh0raix as a **Go-based** ransomware family aimed at QNAP NAS appliances, encrypting files with **AES**, appending the `.encrypt` extension, and dropping a `README_FOR_DECRYPT.txt` ransom note. Analysis indicated the operators likely gained access by brute-forcing credentials and exploiting known flaws, and that the malware communicated with a Tor-hidden command-and-control service through a SOCKS5 proxy at `192.99.206[.]61:65000`; researchers also noted implementation weaknesses in its key generation that suggested a decryptor might be feasible.
Aug 15, 2026
CISA and the UK National Cyber Security Centre warned that **QSnatch** malware compromised tens of thousands of QNAP network-attached storage devices, with about **62,000 infected systems** identified globally in mid-2020, including roughly **7,600 in the United States** and **3,900 in the United Kingdom**. The malware targeted QNAP NAS appliances to steal administrator credentials, enable **SSH backdoor** and **webshell** access, exfiltrate files, and block firmware updates by altering host file entries, leaving affected devices exposed even after administrators attempted remediation. Technical analysis showed QSnatch used at least **two domain generation algorithm (DGA) variants** to locate command-and-control infrastructure and retrieve additional malicious code. One variant generated up to **2,610 algorithmic domains** across **145 TLDs** using multiple time intervals, while a second simpler variant used **30 TLDs** and a 15-day interval; both derived domains from the seed string `IbjGOEgnuD` through a SHA-1 and Base64-based process. Authorities said the more recent campaign began in late 2018 and remained active into late 2019, and advised defenders to run QNAP Malware Remover, perform a full factory reset, update firmware, and limit external exposure of NAS devices.
Aug 15, 2026
QNAP has patched 14 vulnerabilities across **QTS**, **QuTS hero**, **QuTS cloud**, and **QVP** that affect NAS and surveillance appliances, with impacts ranging from denial of service and information disclosure to privilege escalation and remote code execution. The vendor’s advisory `QSA-26-10` describes multiple bug classes, including command injection, buffer overflow, broken access control, URL injection, NULL pointer dereference, and uncontrolled resource consumption, and rates the issues as **Important**. The most serious flaws include command injection vulnerabilities `CVE-2025-66273`, `CVE-2025-66279`, and `CVE-2026-22893`, which can allow arbitrary command execution through username handling or administrative APIs, including one privilege-escalation scenario. QNAP also fixed `CVE-2025-59382`, a password-reset URL manipulation issue that can expose credentials. Fixed releases include **QVP 2.8.0**, **QuTS cloud C5.2.9**, **QTS 5.2.9.3499**, and **QuTS hero h5.2.9**; administrators were urged to update immediately, avoid exposing management interfaces to the internet, and maintain snapshots and offline backups because internet-facing NAS devices are frequent ransomware targets.
Jun 29, 2026