Security News > 2021 > December > QNAP NAS devices targeted by new bitcoin miner

Unsecured QNAP NAS devices are getting covertly saddled with a new bitcoin miner, QNAP has warned users.

"Once a NAS is infected, CPU usage becomes unusually high where a process named '[oom reaper]' could occupy around 50% of the total CPU usage. This process mimics a normal, legitimate kernel process with the same name. However, while the legitimate kernel process PID is usually below 1000, the bitcoin miner PID is usually greater than 1000," the company explained.

How to remove the bitcoin miner and protect your QNAP NAS?

Network-attached storage devices are often used by consumers and small-to-medium businesses for storing and sharing files and/or backups, and they are often exposed to the public internet.

While attacks aimed at achieving covert bitcoin mining are generally not as devastating as those employing ransomware or other sophisticated malware, they can still be a nuisance and result in unexpected costs.

QNAP has provided instructions on how consumers and SMB administrators can determine if the running process [oom reaper] is normal system process or has been created by the bitcoin malware, and has offered advice on how to remove it.

News URL

https://www.helpnetsecurity.com/2021/12/09/qnap-nas-bitcoin-miner/