Yet another Bitcoin Mining malware targeting QNAP NAS devices

[ad_1]

Network attached storage (NAS) device maker QNAP issued a new warning on Tuesday regarding cryptocurrency mining malware targeting its devices, urging customers to take preventative measures with immediate effect.

“A bitcoin miner has been reported to target a QNAP NAS. Once a NAS is infected, CPU usage becomes unusually high when a process named ‘[oom_reaper]”Could occupy about 50% of total CPU usage,” the Taiwanese company said in an alert. “This process mimics a kernel process but its [process identifier] is generally greater than 1000. “

QNAP said it is currently investigating infections, but did not share more information on the initial access vector used to compromise NAS devices. Affected users can remove the malware by restarting the appliances.

In the meantime, the company recommends that users update their QTS (and QuTS Hero) operating systems to the latest version, apply strong passwords for administrator accounts and other users, and refrain from exposing NAS devices to the Internet.

QNAP NAS devices have long been a lucrative target for a number of malicious campaigns in recent years.

In July 2020, the cybersecurity agencies in the US and UK released a joint bulletin on a threat that infected NAS devices with data-stealing malware called QSnatch (or Derek). In December 2020, the device manufacturer warned of two high-severity cross-site scripting flaws (CVE-2020-2495 and CVE-2020-2496) that allowed distant adversaries to take control of the devices.

Then, in March 2021, Qihoo 360’s Network Security Research Lab unveiled a cryptocurrency campaign that exploited two security holes in firmware – CVE-2020-2506 and CVE-2020-2507 – to gain root privileges and deploy a miner called UnityMiner on compromised devices. And since April of this year, QNAP NAS devices have also been the target of eCh0raix and Qlocker ransomware attacks.

[ad_2]