Thousands of QNAP users have been infected by a new ransomware variant flagged by the network-attached storage (NAS) vendor last week, according to a security vendor.

Taiwan-headquartered QNAP said last week that customers should urgently upgrade their systems to the latest version of its QTS operating systems and take steps to disconnect devices from the internet to mitigate the campaign.

Dubbed “DeadBolt,” the new ransomware variant demands a 0.03 Bitcoin ($1100) payment in return for a decryption key.

“This is not a personal attack,” reads the notice. “You have been targeted because of the inadequate security provided by your vendor (QNAP).”

Inventory firm Censys last week claimed there were around 5000 such devices impacted by the ransomware, although this is out of a total of 130,000 globally.

Interestingly, the vendor observed that the number fell sharply between January 26 and 27.

“Overnight, the number of services with the DeadBolt ransomware dropped by 1061, down to a total of 3927 infected services on the public internet,” it wrote.

“The exact reason for this drop is unknown at the moment, and we are continuing to monitor the situation. But earlier today, Malwarebytes reported that QNAP released a forced automatic update for their Linux-based operating system called QTS to address the vulnerability. This update reportedly removed the ransomware executable and reverted the web interface changes made by the ransomware.”

QNAP’s extorters had given it the opportunity to pay a flat rate of 50 BTC ($1.8m) to decrypt all customer data, but it does not appear to have acceded to these demands.

Some users have reported that decryption keys they were given following payment did not work.

The Federal Bureau of Investigation (FBI) has issued a Private Industry Notice on protecting against malicious activity by Iranian cyber company Emennet Pasargad (formerly known as Eeleyanet Gostar).

Two Iranian nationals employed by the company were indicted on October 20 2021 by a grand jury in the US District Court for the Southern District of New York over their alleged involvement in a campaign to influence and interfere with the outcome of the 2020 US presidential election.

Seyyed Mohammad Hosein Musa Kazemi and Sajjad Kashian were accused of conspiring with others to run a sophisticated campaign that included sending threatening emails to voters, hacking into the computer networks of an American media company and impersonating a far-right organization to cast doubt over the integrity of electoral ballots.

The Department of the Treasury Office of Foreign Assets Control sanctioned Emennet, four members of the company’s management team and Kazemi and Kashian for attempting to influence the same election.

The Notice states that Emmenet also previously conducted cyber-enabled information operations that used a false flag persona to spread propaganda via text message.

“According to FBI information, in late 2018, the group masqueraded as the ‘Yemen Cyber Army’ and crafted messaging critical of Saudi Arabia,” states the Notice. 

“Emennet also demonstrated interest in leveraging bulk SMS services, likely as a means to mass-disseminate propaganda or other messaging.”

Included in the Notice was a summary of Emennet’s past tactics, techniques and procedures (TTPs), which included using virtual private network services to obfuscate the origin of their activity. 

Over the past three years, Emennet has selected potential victims by performing web searches for leading businesses in various sectors. The group would then scan the websites of the businesses that appeared in the search results for vulnerable software that could be exploited to establish persistent access.

Information gathered by the FBI indicates that Emennet also attempted to leverage cyber intrusions conducted by other actors for its own benefit. 

“This includes searching for data hacked and leaked by other actors and attempting to identify webshells that may have been placed or used by other cyber-actors,” said the FBI.

New research from managed detection and response (MDR) provider Expel found that most ransomware attacks in 2021 were self-installed. 

The finding was included in the company’s inaugural annual report on cybersecurity trends and predictions, Great eXpeltations, published on Thursday. 

Researchers found eight out of ten ransomware infections occurred after victims unwittingly opened a zipped file containing malicious code. Abuse of third-party access accounted for 3% of all ransomware incidents, and 4% were caused by exploiting a software vulnerability on the perimeter.

The report was based on the analysis of data aggregated from Expel’s security operations center (SOC) concerning incidents spanning January 1 2021 to December 31 2021. 

Other key findings were that 50% of incidents were BEC (business email compromise) attempts, with SaaS apps a top target. 

More than 90% of those attacks were geared towards Microsoft O365, while assaults against Google Workspace accounted for fewer than 1% of incidents. The remaining 9% targeted Okta.

Ransomware attacks accounted for 13% of all opportunistic attacks. The five most targeted industries in descending order were legal services, communications, financial services, real estate and entertainment. 

In addition, 35% of web app compromises Expel responded to resulted in the deployment of a crypto miner.

To protect against threats in 2022, Expel recommended implementing network layer controls to detect and block network communications to crypto mining pools and confirming event data recorder (EDR) coverage across all endpoints. 

The company also advised forwarding computing resource alarms to a security information and event management (SIEM) software solution to flag overtaxed resources potentially deployed for crypto-jacking. 

Other advice included defending the self-installation attack surface on Windows, deploying MFA everywhere, especially for remote access, patching and updating regularly and deploying EDR policies in block mode. 

Users were also advised not to expose RDP (remote desktop protocol) directly to the internet. 

“We founded Expel with a goal of bringing more transparency to security,” said Dave Merkel, CEO of Expel, on Thursday. 

“Today we reach a new milestone tied to that commitment – we’re sharing the most important threats and trends our SOC identified last year and their advice on what to do about them.”

The United States Environmental Protection Agency (EPA) has drawn up a 100-day game plan to help protect the nation’s water systems from cyber-attacks.

The Industrial Control Systems Cybersecurity Initiative – Water and Wastewater Sector Action Plan focuses on high-impact acts that can be performed within 100 days to improve cybersecurity across the water sector.

Strategies detailed in the roadmap promote and support the early detection of cyber-threats and the rapid sharing of data across the government to speed up cyber-threat analysis and action.

The plan advocates the establishment of a cybersecurity task force comprising leaders from the water sector. It also calls for the implementation of pilot projects to demonstrate and accelerate the adoption of incident monitoring.

“Cyber-attacks represent an increasing threat to water systems and thereby the safety and security of our communities,” said EPA administrator Michael S. Regan. 

“As cyber-threats become more sophisticated, we need a more coordinated and modernized approach to protecting the water systems that support access to clean and safe water in America.”

The plan was announced on Thursday by the EPA and its federal partners. It was developed by the EPA, the National Security Council (NSC), the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) and the Water Sector Coordinating Council and Water Government Coordinating Council (WSCC/GCC).

“The action plans for the electric grid and pipelines have already resulted in over 150 electricity utilities serving over 90 million residential customers and multiple critical natural gas pipelines deploying additional cybersecurity technologies,” said deputy national security advisor for cyber and emerging technology, Anne Neuberger.  

She added: “This plan will build on this work and is another example of our focus and determination to use every tool at our disposal to modernize the nation’s cyber defenses, in partnership with private sector owners and operators of critical infrastructure.”

The EPA said it intends to “encourage, incentivize and assist” water sector stakeholders to rapidly deploy industrial control systems (ICS) cybersecurity monitoring technologies. 

“Public-private sector collaboration like this initiative is central to protecting the American public and their ability to safely access critical services,” said secretary of homeland security Alejandro Mayorkas.