Will NAS be targeted by ransomware? 3,600 QNAP units were encrypted overnight, and I put three gates on this one at home

On the morning of January 25,

2022, a group of QNAP users abroad opened their NAS and found all their files had turned into garbled text with the .deadbolt extension, and even the management page had been replaced with a ransom letter demanding Bitcoin. Over 3,600 units, overnight. That day, when I looked at the flying Niu at home, my first reaction wasn't to check the hard drive, but to see if it was exposed on the public network. This article will clearly explain the ways ransomware infiltrated and the three barriers I later fell.

first clarify: how the virus enters the door—most people open it yourself

Many people think the virus is just a strange compressed file, but NAS ransomware rarely goes this way. DeadBolt targeted the QTS system vulnerability without any patches. As long as the management page is exposed on the public internet and the firmware is stuck in an old version, the scanner will come knocking in the middle of the night, and you don't have to make any operational mistakes at all. In September of the following year, it came again, this time targeting the Photo Station suite, using the same approach: old version, bugs, and open doors.

another path is credential stuffing. Synology has issued a security notice: a botnet called StealthWorker has been running DSM dictionaries on public websites for years, and admins 123456 such passwords can't last as long as a meal. What posture does your NAS pose to the public internet? The risk is very different:

I've personally tried the idea of "changing port numbers to prevent scanning"—using nmap to scan all the ports of your VPS only takes a few extra minutes, just a placebo. As for leaving the NAS into the DMZ, don't do it—it's like removing the door and the frame together. I've calculated this in the of the port forwarded and DMZ.

really falls for it

To put it bluntly, just to get an idea: encryption is extremely fast—thousands of files in just a few minutes, not a single file remains in the shared folder, and the suffix is a whole bunch of more. The most painful thing is that RAID can't save —ransomware uses your system's normal permissions to write files, encrypts two RAID1 drives together, and takes the RAID5 array without exception. I previously wrote about how to choose a NAS RAID . The core sentence is: RAID prevents hard drive failure, but not files deletion and encryption—it's two different things.

then the ransom letter appears, demanding you hand over Bitcoin to exchange for a decryptor. Security vendors later calculated that even if you pay, you might not get the key. In the DeadBolt wave, victims handed it over twice—the first time, the decryptor ran out and the file was passively tampered with. So don't pin your hopes on ransom, on snapshots and backups in your own hands.

if you really do run into one, don't move around for the first three minutes: Step one: unplug the network cable (or disconnect the router from the router), first place the infection locally, and don't let it crawl along the internal network to the backup machine and other devices; Step two, don't rush to shut down and restart . Some encryption processes aren't even completed yet, and losing power can destroy the unencrypted files, and there may still be key clues in memory; Step three: flip the snapshot . If it rolls back, roll back; if it doesn't roll, run the offline drive. Don't format and reinstall right away—that's like handling the mess for the ransomware.

my three gates: snapshot, one-way backup, and offline drive

the first gate is snapshot . On Synology's side, install Snapshot Replication in the kit center, select the shared folder, enter the snapshot schedule with frequency and number of retained copies, and it starts running—as fast as 5 minutes. Snapshots are read-only; ransomware using SMB protocols can't access them. To delete snapshots, you need administrator privileges to access the underlying layers, which ordinary ransomware scripts can't do. After being infected, roll back the shared folder to the previous snapshot point, just a few minutes later. Feiniu is the same. When creating storage space, select Btrfs as the file system, and the storage settings will have graphical snapshot management without needing to type a single command. If you don't choose Btrfs (like ext4), you don't have this safety net, so the choice of installing the system is more valuable than any remedial afterwards.

a small reminder: if you set the snapshot frequency too high, the hard drive will be ruined by sleep mode. My machine that used to sleep stayed up all night because it took a snapshot every 5 minutes, but later switched to once every hour before it quiets down. I wrote about this in my NAS hard drive sleep troubleshooting article. You have to choose between the snapshot frequency and sleep time or compromise.

second barrier is one-way backup to another device . Affected machines can no longer be used as backup storage locations. My Feiniu is the main user, an old Synology DS220j as a backup machine, with rsync timing and unidirectional pulling. The core only has one command: rsync -avh -- delete /vol1/photo/ admin@192.168.2.10:/vol1/backup/photo/, with the password slipped into the key file and running it hanging down. The direction must be one-way—two-way synchronization is a disaster amplifier: one side of the file is encrypted, the other faithfully syncs the encrypted version over there, overwriting your only healthy backup. If your budget is tight, you can just install an old laptop and use it as a backup device—slower is better, but it's better than nothing.

the third barrier is the offline . The '1 offline copy' rule in the 3-2-1 backup rule (I wrote the details in the of the backup principle) sounds unnecessary at first, but only when extortion comes do you realize it's life-saving. A 4TB drive, plugged in and synced once a month, then unplugged and put in the drawer after syncing. No matter how aggressive the ransomware is, it can't reach a single unplugged hard drive.

Remote access, don't run naked: The management page is not posted on the public website

The gist of Synology's official knowledge base is: unless necessary, do not expose DSM to the internet; To access files remotely, it is strongly recommended to use a VPN first. My current approach is to run WireGuard on the router, connect the phone and computer to the VPN and then connect to the NAS at home, and only open one UDP port on the public network. The 5000 and 5001 ports are not mapped at all. If you find building your own setup troublesome, just install Tailscale into your NAS's Docker, and it's done in ten minutes—no need to open ports.

is more convenient to use QuickConnect or FRP relay, which is also better than port forwarding. At least the management page isn't directly on the public network. Previously, in my post about connecting to my home NAS on network I compared DDNS, fn Connect, FRP, and IPv6 routers. If you want to copy homework, you can check it out. Before you start, check whether you have a public IP at home and whether port forwarding is really working. This is a three-step self-check. I wrote this in the article public IPs. As for which remote plan is more convenient, Synology or Feiniu, you can pair them with How to choose between Synology and Feiniu Let's take a look together.

four small things to do while you're at it

First, let's verify in two steps. DSM and Feiniu both support it. The phone verifier uses a 6-digit code, and even if the password is pulled out of the dictionary, it won't be able to get in. This step offers the best cost performance. 2. Enable automatic security updates. Firmware downtime is the biggest lesson from DeadBolt's wave—don't hoard security patches. 3. Set clear snapshot retention strategies. After the snapshot fills up the space, some systems will automatically delete old ones. How many days to keep them is up to you, so don't let the defense line disappear quietly. 4. Practice recovery once every quarter, and try rolling back a folder from a snapshot. Unverified backups are basically nonexistent. I've seen too many people's backups only realize they haven't run successfully for three years on the day they got scammed.

Finishing: Reinforce in this order, finish in the afternoon

NAS has RAID to cover if the hard drive breaks, snapshots to be taken if deleted incorrectly, and offline drives to cover the whole device after being extorted. The number of layers you have determines whether you panic or just don't care when you receive a ransom letter late at night.