The Qlocker ransomware gang has shut down their operation after earning $350,000 in a month by exploiting vulnerabilities in QNAP NAS devices.
Starting on April 19th, QNAP NAS device owners worldwide suddenly discovered that their device's files were replaced by password-protected 7-zip archives.
In addition to the encrypted files, QNAP owners found a !!!READ_ME.txt ransom note explaining that their files were encrypted and needed to visit a Tor site to pay a ransom to get their files back.
The Tor site identified the attackers as Qlocker and demanded .01 bitcoins, or approximately $550, to receive the password for their files.
Later, it was determined that threat actors conducted the attacks through
recently disclosed QNAP vulnerabilities that allowed threat actors to encrypt victims' files using the built-in 7-zip application remotely.
Using such a simple approach allowed them to encrypt over a thousand, if not thousands, of devices in just a month.