Response to QSnatch Attacks: Take Actions to Secure QNAP NAS

The QSnatch malware is reportedly being used to target QNAP NAS devices. The National Cyber Security Center Finland (NCSC-FI) has received reports via the Autoreporter service in mid-October about infected devices attempting to communicate with specific command-and-control (C2) servers.


No other vulnerabilities have been found in the current investigation on the malware. We have added rules to remove the QSnatch malware and released Malware Remover 3.5.4.0 and 4.5.4.0.

If you have any questions regarding this issue, contact us through the QNAP Helpdesk.

Recommendation For QTS 4.3.4

• Install and update Malware Remover to the latest version Malware Remover 3.5.4.1
• Use a stronger admin password.
• Enable IP and account access protection to prevent brute force attacks.
• Disable SSH and Telnet connections if you are not using these services.
• Avoid using default port numbers 443 and 8080.

Recommendation For QTS 4.3.5+

• To avoid attacks, we strongly recommend following the steps below:
• Update QTS to the latest version, ex QTS 4.4.1
• Install and update Security Counselor to the latest version.
• Install and update Malware Remover to the latest version. version 4.5.4.0
• Use a stronger admin password.
• Enable IP and account access protection to prevent brute force attacks.
• Disable SSH and Telnet connections if you are not using these services.
• Avoid using default port numbers 443 and 8080.