“Checkmate”: QNAP warns of NAS ransomware

© QNAP

Internet-connected NAS devices from QNAP can currently become the target of “Checkmate” ransomware. The manufacturer warns in a security alert before the attacks. After a successful attack, “Checkmate” encrypts data contained on the NAS and leaves a ransom note.

The first reports from affected users appeared in the forum of “Bleeding computer” already at the beginning of June.

The attack apparently takes place via SMB services that are accessible via the Internet. The ransomware tries to find out the password with dictionary attacks and thus get onto the system. After encryption, it leaves a file titled “!CHECKMATE_DECRYPTION_README” in each folder containing the $15,000 ransom note.

QNAP recommends securing against “Checkmate” with the following steps:

1. Do not expose SMB services to the Internet: This can be done by using a VPN, as one can see in a Instructions describes.
2. Disable SMB 1: To do this, log into QTS, QuTS hero or QuTScloud and then go to “Control Panel -> Network & File -> Win/Mac/NFS/WebDAV -> Microsoft Networking”. There you select “Advanced Options” and then activate under “Lowest SMB Version” SMB 2 or higher.
3. Update the QNAP OS to the latest version: To do this, log in to QTS, QuTS hero or QuTScloud as an administrator. Then go to “Control Panel -> System -> Firmware Update” and click “Check for Update” under “Live Update”.
4. Check all NAS accounts for strong and unique passwords
5. Create a backup for all data and update it regularly

2-bay NAS system

Four 2-bay NAS systems in the test: QNAP, Synology & Co.

We’ve looked at four 2-bay NAS devices, each suited to different tasks or needs, and accordingly they have four…

11.7.2022 from
Alan Friedrichs

Continue to home page

more on the subject

Smartwatches, fitness trackers and more affected

Garmin server down: Ransomware attack causes disruption

The Garmin Connect cloud service used by many wearables is currently experiencing a problem. A ransomware attack is apparently to blame.

Video surveillance and NAS

QNAP closes critical security gap

QNAP has closed security gaps for NAS and video surveillance. One vulnerability was even classified as “critical”.

Beware of these emails

LockBit: False copyright warning brings ransomware

E-mails are currently circulating warning of copyright infringements. In reality, however, it is a ransomware attack with LockBit.

“Professional Service Provider”

Lockbit 3.0: Blackmailers offer bug bounty program

The makers of the Lockbit ransomware appear to be extorting enough money to professionalize their “service”. There’s even a bug bounty program.

malware

Bumblebee: New malware responsible for current…

If you find references to “Bumblebee” in the network, you should react quickly. The malware seems to be the starting point for many current Trojans…