{"id":7229,"date":"2022-09-09T07:20:25","date_gmt":"2022-09-09T07:20:25","guid":{"rendered":"https:\/\/webdev.securin.xyz\/?p=7229"},"modified":"2023-04-28T04:01:35","modified_gmt":"2023-04-28T11:01:35","slug":"how-safe-are-storage-devices-from-a-ransomware-attack","status":"publish","type":"post","link":"https:\/\/10.42.32.162\/articles\/how-safe-are-storage-devices-from-a-ransomware-attack\/","title":{"rendered":"How Safe Are Storage Devices From a Ransomware Attack?"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t

Does your organization use Network Attached Storage (NAS) devices? If you think that backing up data in these devices will keep you safe from a ransomware attack, you might have to revisit your security strategy.<\/strong><\/p>\n

Ransomware groups such as Qlocker and eCh0raix have been targeting QNAP products for a while now. While devices from Western Digital, Synology, ENC Security, and Asustor have also been on the radar, QNAP\u2019s offerings have taken a hit with multiple targeted attempts at exploiting their internet-connected offerings.<\/p>\n

In the latest NAS-related scenario, ALPHV, Maui, and H0lygh0st ransomware, together with the FIN7 APT group, have been playing first fiddle. <\/p>\n

\n\n\n\n\n\n\n\n\n\n
\n

Ransomware<\/b><\/p>\n<\/td>\n

\n

Vendor<\/b><\/p>\n<\/td>\n

\n

Product<\/b><\/p>\n<\/td>\n<\/tr>\n

\n

Deadbolt<\/span><\/p>\n<\/td>\n

\n

QNAP<\/span><\/p>\n<\/td>\n

\n

QNAP NAS running Photo Station<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

Qlocker<\/span><\/p>\n<\/td>\n

\n

QNAP<\/span><\/p>\n<\/td>\n

\n

Hybrid Backup Sync, QTS, QuTS Hero, and QuTS Cloud<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

eCh0raix<\/span><\/p>\n<\/td>\n

\n

QNAP<\/span><\/p>\n<\/td>\n

\n

Photo Station, Hybrid Backup Sync, QTS, QuTS Hero, and QuTS Cloud<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

Maui<\/span><\/p>\n<\/td>\n

\n

TerraMaster<\/span><\/p>\n<\/td>\n

\n

NAS running TerraMaster operating system<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

H0lyGh0st<\/span><\/p>\n<\/td>\n

\n

TerraMaster<\/span><\/p>\n<\/td>\n

\n

NAS running TerraMaster operating system<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

ALPHV<\/span><\/p>\n<\/td>\n

\n

Veritas<\/span><\/p>\n<\/td>\n

\n

Backup Exec<\/span><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Apart from the above, another product being exploited is the Veeam Backup and Replication Server, although the attacker in this case is the FIN7 APT group that has been known to deploy the BlackBasta ransomware.<\/p>\n<\/div>\n

Recent Updates:<\/h2>\n

More recently, ransomware groups like DeadBolt, Checkmate, and NamPoHyu have joined hands with Qlocker and eCh0raix to go after exposed storage devices.<\/p>\n

Sep 06, 2022: <\/strong>DeadBolt ransomware was observed as exploiting CVE-2022-27593, a vulnerability in certain QNAP NAS devices running Photo Station.<\/p>\n

\n

Repeated attempts have been made to compromise all forms of storage devices in the last quarter of 2022, and the exploitation has continued in 2023. We urge organizations to patch associated vulnerabilities, upgrade to the latest firmware, disable port forwarding on routers, or use VPNs to prevent NAS devices from being accessible on the internet.<\/p>\n<\/blockquote>\n

Should CISOs Be Worried About Storage Device Security?<\/h2>\n

Yes. For many organizations that do not have a robust security strategy in place, storage devices are the last line of defense against ransomware attacks. <\/strong><\/p>\n

Storage devices form the crux of an organization and hold all the data that is needed for their day-to-day operations. In fact, with the work-from-home scenario, all organizations prefer network-attached devices that can be accessed from anywhere, at any time.<\/p>\n

On the other hand, increased network accessibility has led to an increased concern for data backups. This has resulted in Network Attached Storage (NAS) devices replacing legacy hardware for maintaining data backups. These data backups serve as the organization\u2019s fallback measure in case of a cyberattack.<\/p>\n

Securin researchers are tracking this trend as part of our ransomware research. Check out our quarterly ransomware reports<\/a> for more information about storage devices and the threats targeting them.<\/strong><\/p>\n

Attacks on Storage Devices<\/h2>\n

Let us look at some of the incidents from early 2022 that had impacted storage devices connected to the internet. These are a clear indication that the attacks on storage devices are continuous and recurring, making it a true cause for concern. Furthermore, it is not just local storage that is being targeted; cloud storage is as vulnerable to attacks as any other internet-connected device.<\/p>\n