{"id":31545,"date":"2019-10-31T19:09:00","date_gmt":"2019-10-31T19:09:00","guid":{"rendered":"http:\/\/ffbb1781-a272-4532-962d-56b4ec100a5f"},"modified":"2019-10-31T19:09:00","modified_gmt":"2019-10-31T19:09:00","slug":"thousands-of-qnap-nas-devices-have-been-infected-with-the-qsnatch-malware","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/thousands-of-qnap-nas-devices-have-been-infected-with-the-qsnatch-malware\/","title":{"rendered":"Thousands of QNAP NAS devices have been infected with the QSnatch malware"},"content":{"rendered":"

\"world<\/span><\/p>\n

Hackers have infected thousands of network-attached storage (NAS) devices from Taiwanese vendor QNAP with a new strain of malware named QSnatch<\/strong>.<\/p>\n

Over 7,000 infections have been reported in Germany alone, the German Computer Emergency Response Team (CERT-Bund) said today<\/a>. Thousands more are believed to be infected worldwide, in what appears to be an ongoing outbreak.<\/p>\n

Information on how QSnatch works is still scant, at the time of writing. The only report<\/a> comes from the National Cyber Security Centre of Finland (NCSC-FI), the first cybersecurity organization to spot the malware last week.<\/p>\n

NCSC-FI members have not yet discovered how this new threat spreads and infects QNAP NAS systems; however, once it gains access to a device, QSnatch burrows into the firmware to gain reboot persistence.<\/p>\n

An analysis of the malware’s code revealed the following capabilities:<\/p>\n