The QNAPCrypt ransomware is a direct evolution of the eCh0raix ransomware. eCh0raix was known for making targeted attacks on QNAP and Synology NAS devices. After numerous successful attacks the group ceased attacks and later appeared as QNAPCrypt.
Unlike eCh0raix, QNAPCrypt has focused its attention exclusively on QNAP NAS, as its name already alludes to. For the vast majority of the time the most sensitive data for companies is stored on these devices.
This shows that the group’s attacks are not random and not focused on ordinary users, but on specific companies that have a large flow of information.
The group exploits known vulnerabilities in QNAP such as CVE-2021-28799, even though the update to fix this vulnerability has already been released, some companies do not pay attention to this and continue with their outdated systems.
The prices charged by QNAPCrypt vary according to the size of the company attacked and the amount of files encrypted. The amount charged for the release of the decryption key, must be done in cryptocurrency, usually Bitcoin.
Cryptocurrencies are the primary means of receiving ransom payments because they are virtually untraceable.
Encrypted files are given a new extension to their name, “.encrypt” is added, these files will be more available to the user.
After the encryption is finished, the ransomware locks the system and presents a ransom note named ‘README_FOR_DECRYPT.txt’, in it contains the necessary information for the victim to contact the group.
Recover Files Encrypted by Ransomware QNAPCrypt
Digital Recovery specializes in recovering data encrypted by ransomware, and also specializes in NAS system. Which makes us perfect for recovering data encrypted by QNAPCrypt ransomware.
With over 20 years in the market, we specialize in recovering NAS, DAS and SAN Storages and any RAID level.
The entire process is totally confidential, and we guarantee this through the Confidentiality Agreement (NDA).
Our portfolio includes remote recovery, which can be done from anywhere in the world and on any storage device.
Contact our experts and start the recovery right now.