Qlocker ransomware shuts down after extorting hundreds of QNAP users

[Gandalf_The_Grey]

The Qlocker ransomware gang has shut down their operation after earning $350,000 in a month by exploiting vulnerabilities in QNAP NAS devices.

Starting on April 19th, QNAP NAS device owners worldwide suddenly discovered that their device's files were replaced by password-protected 7-zip archives.

In addition to the encrypted files, QNAP owners found a !!!READ_ME.txt ransom note explaining that their files were encrypted and needed to visit a Tor site to pay a ransom to get their files back.

The Tor site identified the attackers as Qlocker and demanded .01 bitcoins, or approximately $550, to receive the password for their files.

Later, it was determined that threat actors conducted the attacks through recently disclosed QNAP vulnerabilities that allowed threat actors to encrypt victims' files using the built-in 7-zip application remotely.

Using such a simple approach allowed them to encrypt over a thousand, if not thousands, of devices in just a month.

Today, in BleepingComputer tests and victim's reports in our Qlocker support topic, all of the Qlocker Tor sites are no longer accessible, and victims no longer have a way to pay the ransom.

Since the DarkSide ransomware attack on Colonial Pipeline and the subsequent intensifying of pressure by US law enforcement, the DarkSide ransomware shut down, and REvil has begun to restrict their targets.

Since then, other ransomware operations' Tor sites have gone offline, including those for Ako/Ranzy and Everest.

It is not clear if the shutdown of the Qlocker sites is related to fear of increased law enforcement activity.