IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

QNAP warns of ransomware targeting internet-facing NAS products

The manufacturer has provided a guide to securing vulnerable products amid ongoing attacks

QNAP customers have been advised that cyber attackers are targeting its network-attached storage (NAS) products with ransomware and have been encouraged to secure their devices at the earliest opportunity.

Ransomware and brute-force cyber attacks have been "widely targeting" QNAP's internet-facing NAS products, according to the manufacturer which published a products security statement on Friday. 

NAS drives that are exposed to the internet without any protection are particularly vulnerable to the attacks and users are advised to revisit their security settings to ensure devices are adequately protected.

The scale of attacks is currently unclear and QNAP also didn't specify what strain of ransomware the attackers are using, or where the attackers are based. IT Pro has contacted QNAP for additional comment.

Screenshot of QNAP dashboard

QNAP

To check if a NAS drive is vulnerable to the attacks QNAP has observed, users should open the QNAP Security Counselor on their NAS products. The NAS is at high risk if there is an artefact that reads: 'The System Administration service can be directly accessible from an external IP address via the following protocols: HTTP' on the dashboard. QNAP also has a guide for users on how to check which ports on a router are exposed to the internet.

Securing the NAS

Screenshot of router dashboard with instructions on how to disable port forwarding

QNAP

The first step to fully protect vulnerable products from the ongoing attacks is to disable the port forwarding function of the router. This can be completed via the management interface of a user's router. Users should check their settings and disable the port forwarding setting of NAS management service port which is set at port 8080 and 433 by default.

Screenshot of QNAP cloud dashboard

QNAP

Users should finally disable the universal plug and play (UPnP) function of their QNAP NAS product in the QTS menu in myQNAPcloud. To do this, users can navigate to the 'Auto Route Configuration' tab in the QTS menu and unselect 'Enable UPnP Port forwarding'.

Featured Resources

Four strategies for building a hybrid workplace that works

All indications are that the future of work is hybrid, if it's not here already

Free webinar

The digital marketer’s guide to contextual insights and trends

How to use contextual intelligence to uncover new insights and inform strategies

Free Download

Ransomware and Microsoft 365 for business

What you need to know about reducing ransomware risk

Free Download

Building a modern strategy for analytics and machine learning success

Turning into business value

Free Download

Recommended

Qnap TS-1264U-RP review: Space to spare
network attached storage (NAS)

Qnap TS-1264U-RP review: Space to spare

4 May 2022
Darktrace AI’s Antigena helps stop ransomware attack at Dordogne GHT
ransomware

Darktrace AI’s Antigena helps stop ransomware attack at Dordogne GHT

13 Apr 2022
QNAP ransomware victims dealt double blow as firmware update hampers decryption
network attached storage (NAS)

QNAP ransomware victims dealt double blow as firmware update hampers decryption

1 Feb 2022
QNAP users angry after NAS drives are updated to combat DeadBolt ransomware
ransomware

QNAP users angry after NAS drives are updated to combat DeadBolt ransomware

28 Jan 2022

Most Popular

Windows Server admins say latest Patch Tuesday broke authentication policies
Server & storage

Windows Server admins say latest Patch Tuesday broke authentication policies

12 May 2022
Russian hackers declare war on 10 countries after failed Eurovision DDoS attack
hacking

Russian hackers declare war on 10 countries after failed Eurovision DDoS attack

16 May 2022
IT admin deletes company’s databases and is jailed for seven years
Policy & legislation

IT admin deletes company’s databases and is jailed for seven years

16 May 2022