The virus mostly targets Qnap devices, but attacks against ASUSTOR servers have also been detected. According to the police, the hijackers have hacked more than 20,000 devices worldwide and at least 1,000 in the Netherlands.

lost hackers

For owners of hacked file storage (Network Attached Storage, NAS) asking for 0.03 Bitcoin, which is about $575 today. In return, they promise to provide a decryption key to restore access to data.

The police paid the ransom, took the decryption keys, and then withdrew their payment. These keys allow you to unlock files such as valuable photos or administrative files without spending victims’ money,
– law enforcement informs in press releases.

The Bleeping Computer publication described how they were successful. RespondersNU’s Ricky Gevers explained that the decryption key is sent to victims immediately, without waiting for the legitimacy of the transaction to be confirmed. Apparently, they are generated automatically without human intervention. This allowed fake low-fee ransom payments to be made when the blockchain was heavily congested. Because blockchain needs time to confirm transactions, the police managed to complete the transactions, get the keys and immediately cancel the payments..

“We specifically traded with minimal commissions. We had to be rude and do our best because we knew the attackers would fix everything quickly,” says Gevers. reported their attacks, so most of them got their decryption keys absolutely free.”

Unfortunately, the scammers fully understood how they were scammed and now require double verification before handing over the decryption keys to the victims.