TF-MAL-elf.qsnatch

Description

ThreatFox malware family `elf.qsnatch`. Printable name: QSnatch.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (1)

• ThreatFox: IOCs for this family ThreatFox Malwares

• QSnatch (Malware Family)
  web:malpedia.caad.fkie.fraunhofer.de

  The malware infects QNAP NAS devices, is persisting via various mechanisms and resists cleaning by preventing firmware updates and interfering with QNAP MalwareRemover.

  2026-05-22 05:22 UTC
• QNAP NAS and QSnatch - What You Need to Know
  web:nascompares.com

  How Does QSnatch enter the QNAP NAS? Additionally, the malware is modular (applied gradually) and hinges on allowing the attackers to remotely change and adapt the settings on an infected machine. The good news is that the malware can be removed, but this is a gradual process and below we have detailed the QNAP recommendations.

  2026-05-22 05:22 UTC
• Qsnatch threat description | NordVPN
  web:nordvpn.com

  Qsnatch is a trojan that targets network-attached storage (NAS) devices. It sneaks into systems through unpatched vulnerabilities and phishing attacks.

  2026-05-22 05:22 UTC
• QSnatch malware Targeting QNAP NAS Devices - Rewterz
  web:rewterz.com

  Analysis shows that QSnatch malware contains multiple functionalities such as CGI password logger, Credential scraper, SSH backdoor, Exfiltration, Webshell functionality for remote access.The malware appears to gain persistence by preventing updates from installing on the infected QNAP device.

  2026-05-22 05:22 UTC
• Removing Qsnatch Malware - Software Tested
  web:softwaretested.com

  How to Remove the Qsnatch Malware It is not sure whether the malware was created for DDoS attacks, cryptocurrency mining, or to serve as a backdoor for QNAP devices developed to steal confidential data or future host malware . But as of now, the only successful method of removing QSnatch is to perform a full factory reset of the NAS device.

  2026-05-22 05:22 UTC
• BSI - Qsnatch
  web:www.bsi.bund.de

  Name of Malware : Qsnatch Type of Malware : Trojan, backdoor Affected Operating System: Linux Affected Device Types: NAS devices Impact: medium What is Qsnatch ? Qsnatch is a trojan for Linux devices that primarily attacks network drives manufactured by QNAP. Its functions include stealing access data and opening backdoors to infected devices. Through this backdoor, the attacker can gain access ...

  2026-05-22 05:22 UTC
• Potential Legacy Risk from Malware Targeting QNAP NAS Devices
  web:www.cisa.gov

  All QNAP NAS devices are potentially vulnerable to QSnatch malware if not updated with the latest security fixes. The malware , documented in open-source reports, has infected thousands of devices worldwide with a particularly high number of infections in North America and Europe.

  2026-05-22 05:22 UTC
• PDF Alert: Potential legacy risk from malware targeting QNAP NAS devices
  web:www.ncsc.gov.uk

  All QNAP NAS devices are potentially vulnerable to QSnatch malware if not updated with the latest security fixes. The malware , documented in open-source reports,1 has infected thousands of devices worldwide with a particularly high number of infections in North America and Europe.2 Further, once a device has been infected, attackers can prevent administrators from successfully running firmware ...

  2026-05-22 05:22 UTC
• How to prevent attacks by QSnatch - QNAP
  web:www.qnap.com

  QSnatch malware is targeting QNAP NAS with previous firmware/application versions, all vulnerabilities had since been fixed on current versions. QNAP had also updated Malware Remover application on November 1, 2019 to detect and remove any remaining malware on the NAS. Kindly refer to our updated security advisory for more detail. QNAP NEWS room How to prevent attacks by QSnatch 1. Update to ...

  2026-05-22 05:22 UTC
• QSnatch Malware general post. Information and current status.
  web:www.reddit.com

  Since QSnatch is generating so much fear in our community, I have decided to make this post to keep all the information available updated. This post will be updated as more information is available. QSnatch is a malware detected in October, that seems to grab credentials from the unit to steal them.

  2026-05-22 05:22 UTC

Only Available for Registered Users. Sign in to view.