Qnap qblocker archive#

Pair the profit with the fact that the felons didn’t have to invest a penny in creating a separate ransomware program and are using an open-source archiver instead, and the whole extortion model gets really offbeat and crafty. Note that this was just five days since the campaign began. Security researchers were able to track down the payments based on BTC addresses in ransom notes – they found that the malefactors received at least $260,000 as of April 24, 2021. In the Qlocker scenario, though, the relatively small ransom plays into crooks’ hands, as users are less hesitant when deciding whether or not to pay. This is interesting because most ransomware actors want much bigger amounts reaching thousands or tens of thousands of dollars per device. The site adds clarity to the blackmail by demanding 0.01 Bitcoin (worth about $500 at the time of writing) for the recovery password. Qlocker also drops a ransom note that explains what happened and provides an ID that must be entered to log into a specified Tor payment page uniquely associated with the victim.

Qnap qblocker archive#

Once this stage is completed, users cannot open their files that were moved into password-protected archive entities. Tor payment page used by Qlocker ransomwareĪccording to victims’ observations, the only conspicuous red flag is that numerous instances of the 7z process are visible in the Resource Monitor utility during the attack. With a fairly strong cryptographic algorithm being part of 7zip feature set, the target items undergo unauthorized encryption, which in turn allows Qlocker operators to set an ultimatum and demand money for decrypting files that suddenly became appended with the *.7z extension and, worst of all, inaccessible. The damage in this case goes beyond password-protecting victims’ files.

The gang in charge has been exploiting vulnerabilities in several components of the QNAP network-attached storage (NAS) infrastructure to infiltrate the corresponding devices and remotely run the 7zip archive application to lock down data.

An outbreak of a new unusual ransomware strain called Qlocker has demonstrated that cyber extortionists are good at outsmarting traditional security mechanisms and don’t mind taking shortcuts.