AgeLocker ransomware targets QNAP NAS devices and encrypts data , while in some cases stealing files victims'
AgeLocker ransomware uses an encryption algorithm called Age (Actually Good Encryption), which is designed to replace GPG for encrypting files, backups , and streams.
AgeLocker was first discovered in July 2020 and used this algorithm to encrypt its victims' files.
AgeLocker ransomware targets QNAP NAS devices
It is said that since late August 2020, AgeLocker or another ransomware using the same encryption has been targeting exposed QNAP NAS devices and encrypting their files.
A victim uploaded an encrypted file to ID Ransomware and analysis showed that it was encrypted with the Age cipher.
As it turns out, AgeLocker continues to target QNAP NAS devices to this day, all over the world.
When the ransomware encrypts files, it leaves a ransom note named HOW_TO_RESTORE_FILES.txt. This note informs the victim that they have been the victim of a ransomware attack and that their QNAP device has been encrypted.
“Unfortunately, malware has infected your QNAP NAS device and a large number of your files have been encrypted using a hybrid encryption scheme“.
In some cases, the attackers said they first stole victims' files and then encrypted them. These files included "medical data, scans, backups, etc."
At this time, we do not know how the hackers gained access to QNAP devices or the amount of money they are demanding. However, what is worrying is that there is no free way to recover files encrypted by AgeLocker ransomware.
How to protect your QNAP NAS devices?
As we read on Bleeping Computer, QNAP NAS devices are often targeted by hackers. For example, they have been attacked by the eCh0raix Ransomware. At the time, QNAP had provided some advice on protecting the devices and had emphasized the importance of updating firmware and patching vulnerabilities.
- Log in to QTS as an administrator.
- Go to Control Panel > System > Firmware Update.
- In the Live Update section, click Check for Update.
- QTS downloads and installs the latest update.
You can also get updates from the QNAP website. Go to Support > Download Center and update the specific device (manually).
QNAP also recommends users to update the Photo Station software:
- Log in to QTS as an administrator.
- Open the App Center and click the magnifying glass. A search box appears.
- Type “Photo Station” and then press the ENTER key.
- You will find the Photo Station app in the results.
- Click Update (The Update button is unavailable if you are using the latest version).
- A confirmation message appears.
- Click OK.
- The application is being updated.
Finally, all QNAP NAS device owners should take some general measures to protect themselves from ransomware and other malware:
- Change the passwords for all accounts on the device
- Remove unknown user accounts from the device
- Make regular updates to firmware and all applications
- Remove unused or unknown apps from your device
- Install the QNAP MalwareRemover app
- Set an access control list for the device (Control Panel -> Security -> Security)
