MalwareExploits 1 CVE

Qlocker

Qlocker is a ransomware family that targeted QNAP network-attached storage devices at scale beginning in April 2021. It primarily affected internet-exposed QNAP NAS systems used by small businesses and home or SOHO environments. Rather than implementing a conventional custom file-encryption routine, Qlocker abused the built-in 7-Zip utility on compromised devices to move victim data into password-protected archives, leaving victims unable to access their files without an attacker-controlled password. Infected systems typically displayed a ransom note directing victims to a Tor-based payment portal, where operators demanded a relatively low ransom, commonly 0.01 bitcoin, to retrieve the archive password.

Qlocker has been associated with exploitation of vulnerabilities in QNAP software, including flaws in Hybrid Backup Sync and Multimedia Console or Media Streaming components. Reporting also tied some incidents to abuse of a hardcoded backdoor account removed from Hybrid Backup Sync. The malware was described as Python-based and optimized for rapid, large-scale compromise of vulnerable NAS appliances. Some activity also involved deletion of snapshots, which hindered recovery efforts. Qlocker campaigns were notable for high victim volume, low per-victim ransom demands, and operational use of Tor payment infrastructure. Operators later shut down their payment sites after collecting substantial proceeds, leaving some victims without a recovery path. Qlocker is one of several ransomware families known for directly targeting NAS platforms, especially QNAP devices.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

1 CVES

CVE-2021-28799Improper Authorization in QNAP HBS 3Exploited in the wild

they likely exploited the same security flaw (the CVE-2021-28799 remote code execution bug) to gain access to the server | a QNAP network-attached storage (NAS) device typically used by small businesses and previously infected with QLocker ransomware

via bleeping computerbleepingcomputer.com

MITRE ATT&CK

Techniques & procedures

10 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1078Valid AccountsEvidence1

It was later confirmed that Qlocker ransomware operators used the removed backdoor account to hack into some QNAP customers' NAS devices and encrypt their files.

T1190Exploit Public-Facing ApplicationEvidence6

On June 21, we caught an attack targeting QNAP HBS3 with an exploit of CVE-2021-28799.

Execution

1 technique

T1059Command and Scripting InterpreterEvidence1

Once in, the ransomware uses the built-in tools to attack the system.

Persistence

2 techniques

T1078Valid AccountsEvidence1

It was later confirmed that Qlocker ransomware operators used the removed backdoor account to hack into some QNAP customers' NAS devices and encrypt their files.

T1505.003Web ShellEvidence1

backup.php... executes the commands that are passed along in the command argument as this script is a common web shell.

Privilege Escalation

2 techniques

T1068Exploitation for Privilege EscalationEvidence1

Once the weakness is exploited, the malware could obtain the inappropriate permission level of the QNAP NAS involved.

T1078Valid AccountsEvidence1

It was later confirmed that Qlocker ransomware operators used the removed backdoor account to hack into some QNAP customers' NAS devices and encrypt their files.

Stealth

2 techniques

T1070Indicator RemovalEvidence1

After the encryption begins, Qlocker will leave a ransom note and delete itself to increase the difficulty for investigation.

T1078Valid AccountsEvidence1

It was later confirmed that Qlocker ransomware operators used the removed backdoor account to hack into some QNAP customers' NAS devices and encrypt their files.

Collection

1 technique

T1560Archive Collected DataEvidence1

Qlocker is a Python-based ransomware that uses the 7-Zip utility to encrypt the files in the NAS with a generated password.

Command and Control

1 technique

T1071Application Layer ProtocolEvidence1

QNAP owners found a !!!READ_ME.txt ransom note explaining that their files were encrypted and needed to visit a Tor site to pay a ransom to get their files back.

Impact

2 techniques

T1486Data Encrypted for ImpactEvidence4

QNAP NAS device owners worldwide suddenly discovered that their device's files were replaced by password-protected 7-zip archives.

T1490Inhibit System RecoveryEvidence2

This script deletes snapshots of the NAS so that a user cannot recover files from those snapshots.

INDICATORS OF COMPROMISE

IOCs tracked for this family

1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

1 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in app—

ACTIVITY FEED

Recent activity

15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

15 SOURCESView more in app

macnica security blogNews

Jan 10, 2025

QNAP社製NASを狙うDeadBoltランサムウェアに関連した調査 - セキュリティ研究センターブログ

QNAP NASの脆弱性悪用事例として過去の比較対象として言及されたランサムウェア。

bleeping computerNews

Mar 8, 2024

QNAP warns of critical auth bypass flaw in its NAS devices

Ransomware operation reported targeting QNAP NAS devices.

the record mediaNews

Jan 26, 2023

New Qlocker ransomware is hitting hundreds of QNAP NAS devices per day | The Record from Recorded Future News

Ransomware targeting QNAP NAS devices; it places victims’ files into password-protected 7zip archives and demands a ransom payment for recovery.

the hacker newsNews

Feb 25, 2022

New "SockDetour" Fileless, Socketless Backdoor Targets U.S. Defense Contractors

Ransomware previously infecting the compromised QNAP NAS server that also hosted SockDetour; mentioned as part of the access context rather than the main subject.

+10 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching1

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities1

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping10

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Qlocker