The Qlocker ransomware gang has ended its "operation"after earning $350,000 in a month by exploiting vulnerabilities in QNAP NAS devices. Since April 19, QNAP NAS device owners around the world have suddenly discovered that their device files have been replaced with password-protected 7-zip archives.
In addition to the encrypted files, device owners found a ransom note titled "!!!READ_ME.txt" that stated that their files had been encrypted and that they needed to visit a Tor site to pay a ransom to get their files back.
Read also: Unupdated QNAP NAS devices are being hacked for cryptomining
The Tor site reported that the Qlocker ransomware gang was behind this activity and was demanding 0.01 bitcoin (about 550) to give victims the password to their files.
It was later discovered that the hackers carried out the attacks through recently discovered vulnerabilities in QNAP devices, which allowed them to encrypt victims' files using the built-in 7-zip application remotely.
With this simple approach they were able to encrypt over a thousand, if not thousands, of devices in just one month.
See also: How long do ransomware groups stay on networks before being detected?
As a possible indication of their impending end of business, Qlocker's Tor sites began displaying the message "This site will be closing soon.
More recently, the Qlocker gang has begun a bait-and-switch tactic in ransom payments.
Victims reported that after paying the required 0.01 bitcoin and submitting the transaction ID to Qlocker's Tor site, the site said that victims needed to pay another 0.02 bitcoin to get their files back.
Eventually, the above site was shut down, but another Qlocker Tor site appeared about a day later.
Proposal: DarkSide ransomware gang made $90 million in 9 months
According to reports, Qlocker's Tor sites are no longer accessible and victims no longer have a way to pay the ransom.
It is unclear whether the shutdown of the Qlocker toy sites is related to the gang's fear of increased law enforcement action.
The fact that hackers were not asking for millions of dollars to recover files, but only $500, led many businesses to pay the ransom to recover their files.
Information source: bleepingcomputer.com
