Researchers have identified two campaigns of activity for QSnatch malware. There were two different campaigns which likely ended in the end of 2020 but organizations running vulnerable versions still are on the potential risk.
The infection vector has not been identified, but QSnatch appears to be injected into the device firmware during the infection stage, with the malicious code subsequently run within the device, compromising it. The attacker then uses a domain generation algorithm (DGA)—to establish a command and control (C2) channel that periodically generates multiple domain names for use in C2 communicationsw. Analysis shows that QSnatch malware contains multiple functionalities such as CGI password logger, Credential scraper, SSH backdoor, Exfiltration, Webshell functionality for remote access.The malware appears to gain persistence by preventing updates from installing on the infected QNAP device. The attacker modifies the system host’s file, redirecting core domain names used by the NAS to local out-of-date versions so updates can never be installed.