Researchers have discovered a new hacking attack that has infected thousands of NAS (network-attached storage) devices from QNAP. The hackers used a new malware called QSnatch to infect the devices 
According to a group of German experts, more than 7,000 infections have been observed in Germany alone. Researchers believe that thousands more infections have occurred around the world and that attacks are ongoing.
At the moment, there are not many details about how Qsnatch works. The malware was discovered by the National Cybersecurity Center of Finland (NCSC-FI) last week.
NCSC-FI researchers have yet to discover how Qsnatch spreads and infects QNAP NAS systems. Once it gains access to a device, QSnatch injects itself into the firmware to gain reboot persistence.
The researchers conducted an initial analysis of Qsnatch's code and found the following capabilities:
- Modifying tasks and scripts (cronjob, init scripts)
- Prevent future firmware
- Preventing the native QNAP MalwareRemover app from running
- Username and password theft for all NAS users
However, the above capabilities only indicate what the malware can do. Researchers have not yet discovered its ultimate goal. Qsnatch could be used to carry out DDoS attacks, for cryptomining, or as a backdoor on QNAP devices to steal sensitive data or install malicious payloads (for future attacks).
Some analysts believe that QSnatch operators are still in the botnet and will develop other features in the future.
Currently, the only way to remove Qsnatch is to perform a factory reset of the NAS device.
Some have reported that installing the February 2019 QNAP NAS firmware may also resolve the issue. However, this report has not yet been confirmed by experts.
Therefore, users of QNAP NAS devices should, for now, disconnect their devices from the internet.
Here are some other tips to reduce the effects of a QSnatch infection:
- Change all passwords for all accounts on the device
- Remove unknown accounts from the device
- Update firmware and all applications
- Remove apps from unknown sources or those that are not used frequently
- Installing the QNAP MalwareRemover app via App Center
- Set an access control list for the device (Control Panel -> Security -> Security Level)
QSnatch is the fourth malware to infect NAS devices this year. Previously, a ransomware affected Synology devices, and the eCh0raix and Muhstik ransomware also infected QNAP devices.
