{
	"id": "3b854f89-6b07-4af3-9448-7b0f11e1a974",
	"created_at": "2026-04-06T00:08:15.91815Z",
	"updated_at": "2026-04-10T03:20:22.074941Z",
	"deleted_at": null,
	"sha1_hash": "67637420c21780d231745fdfc125ddb51d7a9d2b",
	"title": "QNAP warns of eCh0raix ransomware attacks, Roon Server zero-day",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 1994618,
	"plain_text": "QNAP warns of eCh0raix ransomware attacks, Roon Server zero-day\r\nBy Sergiu Gatlan\r\nPublished: 2021-05-14 · Archived: 2026-04-05 23:14:39 UTC\r\nQNAP warns customers of an actively exploited Roon Server zero-day bug and eCh0raix ransomware attacks targeting their\r\nNetwork Attached Storage (NAS) devices.\r\nThis warning comes only two weeks after QNAP users were alerted of an ongoing AgeLocker ransomware outbreak.\r\nThe Taiwan-based NAS appliance maker says that it has received reports of devices impacted by eCh0raix ransomware in a\r\nsecurity advisory published today.\r\nhttps://www.bleepingcomputer.com/news/security/qnap-warns-of-ech0raix-ransomware-attacks-roon-server-zero-day/\r\nPage 1 of 4\n\n0:00\r\nhttps://www.bleepingcomputer.com/news/security/qnap-warns-of-ech0raix-ransomware-attacks-roon-server-zero-day/\r\nPage 2 of 4\n\nVisit Advertiser websiteGO TO PAGE\r\n\"The eCh0raix ransomware has been reported to affect QNAP NAS devices,\" the company said. \"Devices using weak\r\npasswords may be susceptible to attack.\r\nQNAP urged customers to \"act immediately\" to protect their data from potential eCh0raix attacks by:\r\nUsing stronger passwords for your administrator accounts.\r\nEnabling IP Access Protection to protect accounts from brute force attacks.\r\nAvoiding using default port numbers 443 and 8080.\r\nDetailed step-by-step instructions on changing your NAS password, enabling IP Access Protection, and changing the system\r\nport number are available in the security advisory.\r\nWhile QNAP doesn't mention how many reports it received from users directly affected by eCh0raix ransomware in the last\r\nweeks, BleepingComputer has seen an uptick in attack reports on the highly active eCh0raix support topic.\r\neCh0raix activity (ID Ransomware)\r\nActively exploited Roon Server zero-day\r\nToday, although not making a direct connection with the eCh0raix attacks, QNAP also warned of an actively exploited zero-day vulnerability impacting Roon Labs' Roon Server 2021-02-01 and earlier versions.\r\nThe company recommends disabling the Roon Server music server and not exposing the NAS on the Internet to protect it\r\nfrom these active attacks until Roon Labs provides a security update.\r\nTo disable Roon Server on your NAS, you have to follow this procedure:\r\n1. Log on to QTS as administrator.\r\n2. Open the App Center and then click . A search box appears.\r\n3. Type \"Roon Server\" and then press ENTER. Roon Server appears in the search results.\r\n4. Click the arrow below the Roon Server icon.\r\n5. Select Stop. The application is disabled.\r\nQNAP also fixed a command injection vulnerability in the Malware Remover app on Thursday.\r\nThis security flaw would allow remote attackers to execute arbitrary commands on devices running vulnerable app versions.\r\nHeavily targeted by ransomware\r\nQNAP devices were previously targeted by eCh0raix ransomware (also known as QNAPCrypt) in June 2019 and June 2020.\r\nA massive Qlocker ransomware campaign also hit QNAP devices starting mid-April, with the threat actors behind the\r\nattacks making $260,000 in just five days by remotely encrypting data using the 7zip archive program.\r\nAdditionally, QNAP removed a backdoor account (aka hardcoded credentials) in the HBS 3 Hybrid Backup Sync backup\r\nand disaster recovery app.\r\nhttps://www.bleepingcomputer.com/news/security/qnap-warns-of-ech0raix-ransomware-attacks-roon-server-zero-day/\r\nPage 3 of 4\n\nIt was later confirmed that Qlocker ransomware operators used the removed backdoor account to hack into some QNAP\r\ncustomers' NAS devices and encrypt their files.\r\nAs mentioned in the beginning, AgeLocker ransomware also hit QNAP customers two weeks ago and in another campaign\r\ntargeting publicly exposed NAS devices exploiting vulnerable Photo Station versions during September 2020.\r\nAutomated Pentesting Covers Only 1 of 6 Surfaces.\r\nAutomated pentesting proves the path exists. BAS proves whether your controls stop it. Most teams run one without the\r\nother.\r\nThis whitepaper maps six validation surfaces, shows where coverage ends, and provides practitioners with three diagnostic\r\nquestions for any tool evaluation.\r\nSource: https://www.bleepingcomputer.com/news/security/qnap-warns-of-ech0raix-ransomware-attacks-roon-server-zero-day/\r\nhttps://www.bleepingcomputer.com/news/security/qnap-warns-of-ech0raix-ransomware-attacks-roon-server-zero-day/\r\nPage 4 of 4",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"Malpedia"
	],
	"references": [
		"https://www.bleepingcomputer.com/news/security/qnap-warns-of-ech0raix-ransomware-attacks-roon-server-zero-day/"
	],
	"report_names": [
		"qnap-warns-of-ech0raix-ransomware-attacks-roon-server-zero-day"
	],
	"threat_actors": [],
	"ts_created_at": 1775434095,
	"ts_updated_at": 1775791222,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/67637420c21780d231745fdfc125ddb51d7a9d2b.pdf",
		"text": "https://archive.orkl.eu/67637420c21780d231745fdfc125ddb51d7a9d2b.txt",
		"img": "https://archive.orkl.eu/67637420c21780d231745fdfc125ddb51d7a9d2b.jpg"
	}
}