QNAP urges users to secure against Dovecat crypto-mining malware

The Monero-mining malware doesn't steal data but consumes large amounts of CPU and memory

Close-up image of network-attached storage (NAS) device

QNAP has warned its customers that their network-attached storage (NAS) drives might be susceptible to infection by a malware strain known as Dovecat, which infects devices and silently mines cryptocurrency.

The firm has issued a security advisory warning its users about Dovecat, which might infect NAS devices when they’re connected to the internet with weak passwords, according to QNAP’s analysis. 

Reports of Dovecat infecting QNAP devices have been circulating for a few months, with security researcher Matthew Ruffell publishing a breakdown of the strain in October 2020. In this analysis, Ruffell revealed that Dovecat consumes a large amount of CPU and most of the system’s memory to mine Monero, slowing down the machine. 

He added the executable itself isn’t dangerous, in that it doesn’t steal data. All it does is consume computing resources for financial gain in the form of Monero. It can easily be removed by terminating the process and deleting the executable.

QNAP has advised its users to update its Linux-based operating system QTS on NAS drives to the latest version, install the latest version of its recommended antivirus software and install a firewall. Customers should also enable network access protection to protect accounts from brute force attacks, and use stronger passwords for database administrators.

Users should disable SSH and Telnet services if these aren’t in use, as well as disabling any unused services and apps. Finally, using default port numbers including 80, 443, 8080 and 8081 should be avoided.

The company said these measures will make it harder for Dovecat to enter NAS devices, with its Product Security Incident Response Team (PSIRT) working to develop a fix that’ll remove the malware from infected drives.

This is the latest threat faced by QNAP customers, after research published in July 2020 found that tends of thousands of NAS drives are potentially vulnerable to malware that prevents administrators from applying patches.

Although the QSnatch malware, also known as ‘Derek’, is no longer active, the National Cyber Security Centre (NCSC) and US Cybersecurity and Infrastructure Security Agency (CISA) suggested many devices across the world may still be infected.

Featured Resources

Virtual desktops and apps for dummies

An easy guide to virtual desktop infrastructure, end-user computing, and more

Download now

The total economic impact of optimising and managing your hybrid multi-cloud

Cost savings and business benefits of accelerating the cloud journey

Download now

A buyer’s guide for cloud-based phone solutions

Finding the right phone system for your modern business

Download now

What’s next for the education sector?

A new learning experience

Download now

Recommended

Cyber attacks on manufacturing up 300% in a year
Security

Cyber attacks on manufacturing up 300% in a year

11 May 2021
HackBoss malware is using Telegram to steal cryptocurrency from other hackers
cryptocurrencies

HackBoss malware is using Telegram to steal cryptocurrency from other hackers

16 Apr 2021
Hackers use open source Microsoft dev platform to deliver trojans
Security

Hackers use open source Microsoft dev platform to deliver trojans

14 May 2021
2021 state of email security report: Ransomware on the rise
Whitepaper

2021 state of email security report: Ransomware on the rise

10 May 2021

Most Popular

KPMG offers staff 'four-day fortnight' in hybrid work plans
flexible working

KPMG offers staff 'four-day fortnight' in hybrid work plans

6 May 2021
Hackers use open source Microsoft dev platform to deliver trojans
Security

Hackers use open source Microsoft dev platform to deliver trojans

14 May 2021
How to move Windows 10 from your old hard drive to SSD
operating systems

How to move Windows 10 from your old hard drive to SSD

30 Apr 2021