Ransomware e NAS suudu walla biro (Synology/QNAP): Jokkude siifde e feeñninde UPnP¶

Nande diskiiji gonɗi e nder defterdu maa jokkondirndu e Reso (NAS) kuutorgal (Synology DiskStation, QNAP Turbo NAS, TrueNAS, Asustor, TerraMaster, mala Western Digital My Cloud) thrashing jokkude e 100 e nder teemedere huutoraade disko nde foldereeji renndaaɗi ina keewi .deadbolt, .ech0raix, .qlocker, .7z, .lockbit, mala .encrypt file extensions (walla yiyde ekran maa naatgol web NAS lomtinaama e ɗaɓɓaande ransom Bitcoin) ko caɗeele desorɗe tiiɗɗe. Kuutorɗe NAS ko paandaale tedduɗe wonande botnets ransomware otomaatik e nder internet (DeadBolt, Qlocker, eCh0raix / QNAPCrypt, AgeLocker, Chatterbox, e Akira) sabu NAS gooto mo patch mum alaa ina heewi jogaade 10 haa 100 terabyte nguurndam dijital galle walla njulaagu tokooso fof, tee ina heewi feeñde e internet renndo tawa joom mum anndaa ɗum e Router UPnP (Universal Plug and Play) Port-Oto-Naatgol walla sarwisaaji jokkondire ruulde yeeyoowo (myQNAPcloud, Synology QuickConnect, EZ-Internet). Ko adii nde njaltin-ɗaa kaɓirgal AC ngal e nder mahol ngol, aɗa foti waɗde feere arsitektuur 10 sekonnde tiiɗnde tuugnaade e so tawii NAS maa ina huutoroo nate Copy-on-Write (Btrfs walla ZFS) walla mbaydi RAID aada; ngam ŋakkere diskooji ɗi ngonaa ransomware, ƴeewto NAS RAID array bonnaama, diisnondiral keewngal ŋakki, e ZFS/Btrfs ƴellitii, e wonande mborosaaji ransomware baɗɗi e PC, ƴeew mboros bonɗo, ransom, e mboros spy fu kisal routeruuji cuuɗi e kaɓirɗe IoT. So tawii ransomware oo ina metti golle safrirde, sarwisaaji cafrirɗe municipaal, walla gollorɗe kisal ɓalli, noddu limoore cafrirɗe nokku maa (911 to leyɗeele dentuɗe Amerik e Kanadaa, 112 e nder Dental Orop fof, 999 e nder leydi Angalteer) walla ƴeewto regginorde amen hakkunde leyɗeele limooje caɗtuɗe.

Waɗde ɗum jooni¶

1. Pullo Eternet ɓanndu (RJ45 / 10GbE) kaɓirgal (kaɓirgal) reso yaltungal caggal NAS JOONI, hade maa meemde kaɓirgal doole:
2. So a ƴettii kaɓirgal Ethernet (kaɓirgal Ethernet) ɗoon e ɗoon, ina taƴa joɗnde yamiroore e jokkondire SSH/HTTP, haɗa NAS ƴettude kuutorɗe sifirgol ɗiɗmere, kadi, ko ɓuri teeŋtude, haɗata ko ɗoon e ɗoon PC desktop mo ñawu nguu renndini e lowre biro maa nokkuure NMBCIFS LAN e dow encryp (\\NAS\Share).
3. Anndit e nder leƴƴanɗe 15 so tawii ko taƴde doole walla dartinde golle sifirde ɗee no laaɓiri:
4. Senaare A: Ransomware ina doga ON PC desktop e LAN maa e siifde piille NAS e dow SMB/Mapped Network Drive: Ko tan ƴettude kaɓirgal NAS Ethernet e Ɗatal 1 ina jokki 100% siifde e NAS. Accu NAS oo ina huɓɓa ngam RAID array mum e filesystem mum ina keddoo laaɓɗo, njahaa seerndude nokku gollorɗo Windows/Mac mo ñawu nguu heɓtii oo.
5. Senngo B: Binndi ransomware ina huutoroo to bannge njuɓɓudi NAS Linux e hoore mum (DeadBolt, Qlocker, eCh0raix):
   • So a waɗii alaa jogaade Btrfs walla ZFS snapshots softinaama (yeru, ɓooyɗo ext4 volume) e diskiiji ɗii ina njuumta no feewi nde NAS siifirta koppi maa tan e fiiluuji ɗii, toɓɓu e jogaade Butoŋ Doole yeeso ɓanndu e dow NAS fotde leƴƴanɗe 5 haa 10 ngam doole ɓuuɓɗe ɗoon e ɗoon (walla ɓuuɓnude fiilngo doole DC/AC so tawii butoŋ oo jaabaaki). Kala minit mo NAS woni e dogde ina addana CPU mum siifde gigabayteeji 5 haa 20 goɗɗi e fiilde maa.
   • Kaɓirgal teeŋtungal (Why DeadBolt & Qlocker victims must NOT reboot after recovery): Ranndooji ɗii ko wayi no Qlocker (ko diwtata piille e nder reentorde password .7z arsiifuuji kuutortooɗi 7z) e DeadBolt sahaa e sahaa fof jogaade ngonka sifirde walla kuutorɗe sifirde e nder /tmp (RAM) walla ƴettude binndol UI web (/home/httpd/index.html). So tawii aɗa jogii haa jooni jokkorgal SSH nokkuwal udditiingal e nder NAS, ƴeewto ps aux e /tmp hade mum ustaade (ƴeew Fase 2 les ɗoo).
6. Naat e nder lowre maa internet / firewall (192.168.1.1 / 192.168.0.1 / UniFi / pfSense / damal ISP) ɗoon e ɗoon e ɓuuɓnude UPnP (Universal Plug and Play) E momtude denndaangal kuule WAN Port Forwarding toɗɗiiɗe NAS maa:
7. Ko ɓuri 80 e nder teemedere e mborosaaji ransomware NAS nder galleeji e birooji tokoosi ina keɓa sabu kuutortooɗo oo ɓuuɓtii "Konfiguraasiyoŋ router otomatik / EZ-Internet / UPnP" e nder njuɓɓudi adanndi, ndi yamiri router galle oo e nder deeƴre yo udditu portooji TCP 5000, 5001, 8080, 8443, 443, 22 (SSH), walla 445 (SMB) to bannge internet renndo fof (Shodan.io / Censys).
8. Softin UPnP haa abada e nder dottaaɗe WAN/NAT router maa e momtude kala kuulal port-forwarding toɗɗangal adrees IP nokkuure NAS.
9. WOTO fuɗɗo, mbaylu, walla dognu "Reset / Reinstall DSM walla QTS" e diskiiji ɗii hade maa ƴeewtaade so tawii ransomware oo ƴettii tan ko feccere OS walla volume domen:
10. E nder njanguuji hono ** .DeadBolt**, malware oo ina winnda hello naatnugol web NAS (index.html) ngam hollirde winndannde ranndo timmunde haɗnde naatde e tablo njuɓɓudi QNAP/Synology, hay so tawii ko les maa Btrfs / ZFS nate walla fiilde wideyoo mawnde (ko ɓuri 20 megabayt) ina heddii haa jooni 100 e nder teemedere e diskiiji ɗii.
11. Ƴeewto so tawii NAS maa ina jogii Btrfs (Synology Snapshot Replication), ZFS (TrueNAS / QuTS hero), mala LVM Nate toɓɓere bolol (QNAP Storage & Snapshots):
12. Ngam Btrfs e ZFS nate ɗee ko janngeteeɗe tan e layer bolok fiilngo (e Synology WORM / Snapshots ɗi mbaylaaka hay gooto waawaa momteede e mbaydi mbaylaandi root konte admin), aɗa waawi heewde ruttaade caggal 100 e nder teemedere e foldere maa renndinde sifirnde e nder leƴƴanɗe 60 tawa alaa ko majji e dokke ɗe njoɓaaka.
13. Ko adii nde njoɓataa kala njoɓdi, anndu ransomware tigi-rigi kuutortooɗo ID Ransomware (id-ransomware.malwarehunterteam.com) e No More Ransom (nomoreransom.org):
14. Soklaaji ransomware NAS mawɗi keewɗi (eCh0raix / QNAPCrypt, dawi Qlocker gal photorec / qrescue ittugol leggal, Muhstik, e SynoLocker) ina njogii decryptors public free walla laabi ƴettugol key forensic ɗi wiɗtooɓe toppitiiɓe sariya e kisal njaltini.

Lekki kuulal : ƴeewndo ransomware NAS ɗoon e ɗoon e laawol reentaade¶

Huutoro ngool doggol golle ngam anndude so tawii njangu nguu ummorii ko e ordinateer LAN walla ko to NAS tan, cuɓo-ɗaa feere ɓurnde sellude :

flowchart TD
    Symptom["NAS ina diwa 100% + Fiildeeji Inndeeji (.deadbolt, .7z, .ech0raix, .lockbit) walla UI Web hollirta ko ekran ransom"] --> PullLAN["ƊATAL 1 (E nder Leƴƴanɗe 5): Sokkit Denndaangal Kaɓirɗe Ethernet Gila caggal NAS"]

    PullLAN --> SourceCheck{"Mbele Sifirde ina jokki e sahaa mo njiyloto-ɗaa kaɓirgal Ethernet NAS ngal?"}

    SourceCheck -->|"EEY: Golle Disk njippiima e Zero nde LAN yaltinaa"| SMBVector["FUƊƊO A: Ransomware ina doga e ordinateer Windows/Mac e nder lowre maa e siifde foldereeji renndaaɗi e dow SMB"]

    SourceCheck -->|"NO: Diskooji NAS ina njokki ɓuuɓde tawa Ethernet ina jokki (Walla Hello Naatgol Web NAS e hoore mum lomtinaama e Ekran Ransom)"| DirectNAS["FUƊƊO B: Binnditagol Ransomware ina huutoroo ko yaawi e nder OS NAS (ina huutoree e UPnP / Portooji WAN peeñɗi 5000, 5001, 8080, 443, 22)"]

    SMBVector --> IsolatePC["Yiytu & Seerndu PC mo ñawu nguu heɓtii oo e LAN maa -> Wartirde foldere NAS renndinde gila e nate Btrfs / ZFS / QNAP walla Hyper Backup"]

    DirectNAS -->SSHCheck{"Mbele aɗa jogii joɗnde SSH nokkuure huuɓtodinnde udditiinde (walla ko Qlocker ina doga 7z)?"}

    SSHCheck -->|"Eey (Qlocker / Golle 7z kuutorteeɗe)"| GrabPass["Ƴeewto ps aux | grep 7z e SSH ngam nanngude binndol laaɓngol 7-Zip Password Gila Args Doggol Yamiroore Ko adii Warde Golle"]
    SSHCheck -->|"Alaa SSH / Diskooji ɓuuɓɗi ɗi nganndaaka"| PowerOff["Hoɗdu Butoŋ Doole NAS 5-10 Leƴƴanɗe ngam Doole Doole-Off tiiɗɗe ɗoon e ɗoon ngam Fiildeeji ɗi siforaaka & nokku mo alaa ko woni e mum oo ina ndeenee"]

    GrabPass --> KillUPnP["ƊATAL 2: Naatde e router -> Softinde UPnP haa abada + Mumtu denndaangal kuule jokkondire porto (5000, 5001, 8080, 443, 22)"]
    PowerOff --> KillUPnP
    IsolatePC --> KillUPnP

    KillUPnP --> RecoveryPath{"Hol Jawdi Recovery Wonndi e NAS?"}

    RecoveryPath -->|"Btrfs / ZFS / QNAP Ɓoornugol Nate Jooni"| SnapRestore["Laɓɓin Feccere OS / Kesɗitingol Firmware -> Rokkude Dowlaaji Renndaaɗi e Nate Ko adii Njoɓdi"]
    RecoveryPath -->|"USB yaajɗo / Restoraaji ruulde caggal nokku (Restoraaji Hyper / HBS 3)"| BackupRestore["Wip & Mahi NAS e dow Firmware Patched -> Wartirde Gila e Backup mo alaa e laylaytol/ruulde"]
    RecoveryPath -->|"Alaa Nate & Alaa Backups"| ForensicCarve["-> Ƴeew NoMoreRansom.org + Doggol PhotoRec / QRescue Taƴre nde rewaani laawol (Haa teeŋti e Qlocker)"]

No NAS Ransomware ɓuuɓtortoo: Vektoruuji ɗiɗi njiyaagu¶

Ko adii nde njokkondirtaa e NAS maa e nder jokkorgal maa lowre nokkuure, aɗa foti anndude hol e jokkorgal naatgol ɗiɗi ceertuɗi no feewi acciri ransomware oo e dow jokkorgal maa mooftirgal:

Daawe 1: Uddude Ƴeewndorɗe Enternet (Router UPnP, Port Forwarding, e Relays duule)¶

So a laɓɓinii walla a artirii NAS maa tawa a uddaani ɓuuɓol reso ngol e router maa, botnets otomaatik ƴeewndotooɗi adrees IP maa renndo maa njuɓɓin NAS oo e nder waktuuji seeɗa caggal nde ngartiraa ɗum e internet. Timmin ndeeɗoo coktirgal reso e router maa ko adii:

1. Naat e nder lowre maa internet / Konsol njuɓɓudi Firewall:
2. Uddit feerorde e ordinateer walla telefoŋ laaɓɗo, naata e IP damal router maa (ko ɓuri heewde 192.168.1.1, 192.168.0.1, 10.0.0.1, walla e laawol app router maa mesh hono UniFi, Eero, Google Home, TP-Link Deco, ASUS Router, Netgear Nighthawk).
3. Darnugo UPnP (Universal Plug and Play) Haa abada:
4. Naat e Yaajde > NAT Naatgol / WAN / Reso > UPnP e jokkitde UPnP e OFF / Muumtuɗo.
5. Koni UPnP ina bonna no feewi wonande joom en NAS: So UPnP ina softi e router maa, kala kaɓirgal gonngal e lowre maa (ina heen "EZ-Internet" walla "Auto Router Configuration" NAS maa, walla malware e telefoŋ smart) ina waawi neldude e nder deeƴre an IGD (Internet Gateway Device) ɗaɓɓaande e router maa wiyde "Uddit Port WAN yaajɗo 8080 e 5001 to IP am nokkuure 192.168.1.50", rewrude e firewall maa tawa a meeɗaa naamnaade password router maa.
6. Mumtu denndaangal jokkondire porto (Virtual Server) & DMZ Kuule toɗɗiiɗe NAS:
7. Yah to Yaajde > Yahdu NAT > Yahdu Port (walla Serveeji Wirtooji) e momtude kala kuulal yahdu portooji TCP walla UDP (80, 443, 5000, 5001, 8080, 8443, 21 FTP, 22 SSH, 873 sinkron, 445 SMB, 32400 Plex so tawii alaa ko haani) to IP NAS maa.
8. Ƴeewto Advanced > DMZ e hoolkiso so tawii DMZ Host ina ŋakki (waɗde IP NAS e nder DMZ router ina feeñnina denndaangal 65 535 portooji TCP e UDP NAS to bannge internet renndo).
9. Hoolkiso gila e Yaasi Reso maa wonde Portooji NAS Zero ina udditaa:
10. Ngillugo shodan.io walla grc.com (ShieldsUP) walla dognude ƴeewndo porto e adres IP maa WAN renndo ngam tabitinde oon porto 5000, 5001, 8080, 8443, 443, e 22 jooni ngarta Filtered / Stealth / Closed.

Faandaare 2: Triage d'urgence spécifique à la strain (Qlocker, DeadBolt, eCh0raix)¶

Ko adii nde momtataa NAS walla yoɓataa njoɓdi, ƴeew hol mbaydi ransomware NAS keeriiɗo mo kaɓirgal maa yani. Kala galle NAS mawɗo ina jogii ŋakkeende karallaagal keeringal baawngal rokkude feccere walla keɓgol keɓe tawa yoɓaani :

1. So tawii Fiilde maa Lomtinaama e .7z Defte defte (Qlocker dow QNAP / Linux NAS)¶

Noy Qlocker golle: E nokku binndol mooftirgel kriptogaraafi keeriiɗo, Qlocker ina doga binndol noddata NAS e hoore mum mahaaɗo 7-Zip (/usr/local/sbin/7z) binndol ngam ɓuuɓnude kala fiilngo e nder konngol kuutorteengol .7z archive caggal ɗuum ina doga Linux no woorunoo rm (unlink) e dow fiilngo asliijo ngoo. - Triage Trick #1 (Nanngude konngol Live in ps aux Ko adii nde njiyloto-ɗaa): To Qlocker woni jooni ina doga e NAS maa kadi aɗa waawi naatde e nokku hee rewrude e SSH (ssh admin@nas-local-ip), dognu ndee yamiroore ɗoon e ɗoon hade maa mumtude:

ps aux | grep 7z

2. So tawii Ekran Naatgol NAS maa Lomtinaama e... DeadBolt Hello njoɓdi (.deadbolt fiiluuji)¶

Noy DeadBolt golle: 1. DeadBolt lomtotoo /home/httpd/index.html (walla /home/httpd/cgi-bin/index.cgi) e hello mum binndol/HTML ngo njiyloto-ɗaa feerorde maa web kala nde njiɗ-ɗaa udditaade tablo QNAP QTS / Asustor ADM, ɗaɓɓoowo Bitcoin ngam waylude jokkorgal desifirgal mawngal 32 alkule hex (jokkondiral e Bitcoin gonɗo e kaɓirgal OP_RETURN njulaagu). 2. No keɓirtaa naatde e Dashboard Admin jaambaaro QNAP QTS / QuTS maa tawa a majjaani dokke maa: - Cuɓal A (Rewrude e SSH nokkuure so tawii ina softi): SSH e nder NAS nokkuure (ssh admin@<nas-ip>), dartina fenaande deadbolt laawol so ina doga, e dogginde binndol restoraasiyoŋ firmware laawɗungol QNAP walla artirde asliwol ngol /home/httpd/index.html gila e natal ROM njuɓɓudi janngeteendi tan (/mnt/HDA_root/update_pkg/). - Cuɓal B (Flash Firmware mo alaa disko + Naatgol Hot-Plug): 1. Doole mum ko NAS. 2. Siftor diskiiji ɗii fof e santimeeteeruuji 2 (1 inch) mbele ɗi ceernda e backplane (limto bay order maɓɓe no moƴƴi e kaset pentoowo ko adii). 3. Doole e NAS tawa alaa diskiiji, yiytu IP mum e Qfinder Pro, so aɗa ɗaɓɓiree e ekran setup hot-plug diskiiji ɗii ngarta e bays mum en laaɓtuɗi, cuɓo-ɗaa "Kesɗitin Firmware tan (Kesɗitin denndaangal Dowlaaji e Cuɓe)" (woto meeɗ ɓuɗɗude "Fuɗɗoode wipe Systems the, 3. Teskorde Decryption e sariyaaji teeŋtuɗi e... DeadBolt: E nder golle jokkondirɗe ɗe Polis ngenndiijo Holannda (Politie), Orop (No More Ransom), e Jaabtiiɓe.nu, reennooɓe sariya keɓii foolde... DeadBolt hulɓiniinde gollotooɓe e sahaa nde njoɓdi mempool ɓeydii e yaltinde ko ɓuri 150 jokkorgal master decryption hade njulaagu Bitcoin lowre-feere njulaagu nguu ustaade e laawol Replace-By-Fee. Lartol deadbolt.responders.nu e nomoreransom.org ngam ƴeewde so tawii maa keeriiɗo DeadBolt adresse victim key ko polis nanngi ɗum.

3. So Fiilde maa Timmii e... .encrypt (eCh0raix / QNAPCrypt)¶

• Yontaaji keewɗi e... eCh0raix (QNAPCrypt) kuutoriima ƴellitaare AES key ŋakkunde walla joginoo yamiroore-e-jokkondiral mum en (C2) lowre nde wiɗtooɓe kisal e reennooɓe sariya nanngi.
• Ngillugo nomoreransom.org e neldude piille ɗiɗi cifaaɗe (walla note ransom README_FOR_DECRYPT.txt) ngam ƴeewndaade Bitdefender / Alaa ko ɓuri ɗum eCh0raix Decryptor hade mum momtude huunde.

Faandaare 3: Wartirde Fiilde maa ummoraade e... Btrfs, ZFS, mala QNAP Nate e nder 60 Sekonnde¶

So tawii NAS maa ko Vector #2 (ordinateer ransomware gonɗo e LAN maa siiftorde foldere renndaande dow SMB), walla so tawii aɗa jogii Immutable (WORM) Nate walla Nate LVM/Btrfs/ZFS ɗe memotaako e nder njuɓɓudi NAS toowndi, aɗa waawi artirde 100 e nder teemedere e piille maa ɗoon e ɗoon:

1. Diskooji Sinoloji (DSM 7.x be Btrfs Koppitagol foto)¶

1. Ko adii fof, hoolkiso so tawii PC gonɗo e LAN maa oo ina seerti e lowre ndee, kadi kesɗitin Synology DSM e yaltinnde cakkitiinde les Panel > Kesɗitin & Restore.
2. Uddit Rewtinnde nate e nder Synology DSM.
3. Ɓoɗɗu Recovery to bannge nano.
4. Suɓo Foldere renndinde (walla... iSCSI LUN) e ɓuɗɗude Rewtin.
5. Yeewtu doggol nate potɗe ƴetteede (GMT+...) e suɓaade natal ƴettaangal ko adii nde sifirde ransomware fuɗɗotoo (ƴeew Golle > Feewnitde ko adii ngam yiytude piille gonɗe e nder oon natal e hoolkisaade ɗe laaɓi, ɗe sifiraaka).
6. Ɓoɗɗu Golle > Wartirde e ndeeɗoo nate (walla Clone e innde hesere so aɗa yiɗi jogaade foldere sifirnde nde memotaako ngam seedeeji ñaawoore tawa aɗa moofta ɗoon e ɗoon koppi laaɓɗo foldere renndinde ndee).
7. Ngam Btrfs ko Koppi-e-Binndol (CoW) filesystem, ruttaade e foldere renndinde 20 terabyte e nate ko adii njiyaagu ina ƴetta ko famɗi fof leƴƴanɗe 10.

2. QNAP NAS (QTS Nate LVM to bannge bolokaaji & QuTS hero ZFS Fotooje)¶

1. So jaambaaro QTS/QuTS oo pattaama, seerndaama e WAN, udditu Deftorde & Nate.
2. Yah to Deftorde > Deftorde/Nate, suɓo Volume Tedduɗo, Volume Sewnde, walla Foldere renndinde ZFS nde toɗɗaa, ɓuɗɗu e Njuɓɓudi Nate (ikon kamera).
3. Suɓo nate laaɓɗe cakkitiiɗe ƴettaaɗe ko adii waktuuji njiyaagu.
4. Yeewtu lekki foldere nder lowre ñaamo ngam hoolkisaade so tawii piille maa ina ngoodi, caggal ɗuum ɓuɗɗu Revert Volume Snapshot (walla cuɓo-ɗaa denndaangal foldere ndee, ɓuɗɗu Restore ngam winndude piille sifirteeɗe ɗee tan).

3. GoongaNAS (CORE / SCALE dow ZFS) e Unraid ( ).ZFS / Btrfs)¶

• E dow NAS Goonga (ZFS): Yah to Deftorde > Nate (walla Reende Dowlaaji > Golle Nate sahaaji), yiytu nate laaɓɗe (tank/share@auto-2026-10-31_12-00), e ɓuɗɗude Rollback (walla tafde nate ɗee e doggol kesol zfs clone tank/share@auto-2026-10-31_12-00 tank/share_recovered ko noon a meeɗaa majjude nate hakkundeeje kese).

Faandaare 4: Harde NAS maa ngam waasde siifde kadi (Doggol ƴeewndo toɓɓe 7)¶

So dokke maa keɓaama, huutoro ɗeeɗoo kuule jeeɗiɗi kuutorteeɗe e kuutorgal maa Synology, QNAP, TrueNAS, walla Asustor hade maa jokkondirde e lowre ndee :

• 1. Hoto meeɗ neldude kala Port e Router maa to NAS maa: Huutoro Tailscale walla WireGuard VPN Do:
• Sosde jokkorgal Tailscale laawɗungal ummoraade e nokku jokkorgal Synology / nokku app QNAP (walla dognude Serwer VPN WireGuard mahaaɗo e router maa).
• Tailscale ina sosa tunnel mesh WireGuard mo alaa ko woni e mum, mo alaa ko woni e mum (100.x.y.z) hakkunde telefoŋ maa, laptop maa, e NAS maa e portooji udditiiɗi zero e firewall router galle maa. Aɗa waawi heɓde fotooje maa NAS, fiiluuji maa, e ekran admin gila e kala nokku e winndere nde tawa NAS maa ina heddii 100% yiyataa e skanndeeruuji internet hono Shodan.
• 2. Softin Default Mahaaɗo oo admin Konte e Sosde njuɓɓudi Innde Keertinnde e 2FA:
• Synology DSM e QNAP QTS fof ina nelda e konte kuutorteeɗe ina wiyee ** .admin** (UID 1024 walla UID 0). Botuuji doole guurɗe otomaatik ina njuɓɓina innde kuutortooɗo admin 24/7.
• Sos konte njuɓɓudi keso tawa ina waɗi innde kuutortooɗo keeriiɗo, naata e ndeen konte kese, yah to Panel kuutorgal > Kuutortooɗo & Goomu (walla Huutortooɓe), e Softinde doggol ngol admin konte.
• Huɓɓu Hoolkiso 2-Factor doole (OTP / Passkey / Approve Sign-in) ngam denndaangal konte njuɓɓudi.
• 3. Ƴeewto ON mo waylaaka (WORM) Fotooje (7-to-14-Day Retention Lock):
• E Synology DSM 7.2+: Uddit Replikaasiyoŋ nate > Nate > Cuɓe > Jadwal, softina nate ñalnde kala, ƴeewto "Softina nate ɗe mbaylaaka" e dumunna ndeenka balɗe 7 haa 14. Hay so hacker wujjii konngol maa root walla huutoriima ŋakkeende kernel e nder DSM, hay gooto (hay gooto root) ina waawi momtude Snapshot mo waylaaka haa waktu hardware balɗe 7 oo timma.
• E dow jaambaaro QNAP QuTS / QTS: Ƴeewndo Koɗorɗe ƴeewndo walla softina WORM (Write Once, Read Many) kuule jogagol e dow peccitagol jokkorgal teeŋtungal, kadi ƴeewto "Reserve Snapshot Space" ina softina.
• 4. Resndu Jamirooje renndinde Reso SMB (Least Privilege) So Infection Laptop Waawaa Siifde NAS oo fof:
• Hoto meeɗ kartal joom NAS maa admin seedanteeje nder Ƴeewndo Fiilde Windows (\\NAS\) e dow laptopuuji ñalnde kala.
• Sos konte kuutortooɗo kuutortooɗo mo wonaa njuɓɓudi ngam heɓde fiilde ñalnde kala, kadi seŋo doggol maa arsiif/foto (yeru, 2010-2025 Family Photos Archive) to Janngu-tan (ro) wonande huutortooɓe desktop ñalnde kala mbele so PC Windows tergal galle nanngii ransomware, PC oo ina waawi janngude ɗeen foldere kono waawaa siifde walla waylude ɗe.
• 5. Ƴeewto Firewall NAS mahaaɗo (Allow LAN + Tailscale Subnets Only) & Haɗde-oto:
• E nder Tappirde kuutorgal Synology > Kisal > Firewall (walla QNAP QuFirewall), sos kuulal doggol jaɓgol tiiɗngal jaɓoowo jokkorɗe tan e lowre maa LAN nokkuure (192.168.1.0/24) e lowre maa Tailscale/VPN (100.64.0.0/10), rewi heen ko kuulal les ngal Yalde Fof. Hay so neɗɗo ina wirnoo e aksidaa UPnP back on to router, filtirde packet nder NAS ndee maa jippin kala packet internet renndo e oon sahaa.
• 6. Softin SSH (Port 22) e Telnet ( ).Port 23) Nde Wonaa Actively Caɗeele:
• Accu SSH ina OFF nder Panel kuutorgal > Terminaal & SNMP e nder golle ñalnde kala no woorunoo; tan toggle ɗum e nder hojomaaji 10 potɗi huutoreede ngam dogginde golle doggol yamiroore, caggal ɗuum ɓuuɓna ɗum ɗoon e ɗoon.
• 7. Siftor Goonga "3-2-1" Backup Duule ɗe mbaylaaka (Hyper Backup / HBS 3):
• Rewta men... backups ordinateer e 3-2-1 doggol reentaade musiiba: ƴeewndaade Sinoloji Hyper Backup walla QNAP Hybrid Backup Sync (HBS 3) ngam pusde jokkorgal sifirngal jamma, jokkorgal deduplicated to bannge kiliyaneeɓe to disk USB yaajɗo mo njiyloto-ɗaa e ɓanndu walla to Object-Locked (S3 Object Lock Compliance Mode) ɓuuɓri duule (Backblaze B2, Wasabi, mala AWS S3) huutoraade jokkorgal API keertiingal append-only.

Limooje emergency diiwaan e porotokolle agence¶

Ñawanɗe ransomware jowitiiɗe e kaɓirɗe NAS ina njuurnitee e nder juɓɓule ngenndiije toppitiiɗe bonanndeeji siber e nder winndere ndee kala, jogorɗe jogaade nokkuuji ɗo kuutorɗe decryption nanngaa (No More Ransom) e rewindaade njuɓɓudi bonanndeeji:

• Leyɗeele dentuɗe Amerik e Kanadaa:
• Nguurndam-Kisal Ɓoornugol: Dial 911 so tawii ransomware ina bonna cellal walla kisal ɓanndu.
• CISA & FBI nokku wullitaango bonanndeeji e internet (IC3): Habrirde kampaañ ranndomaaji NAS (DeadBolt, Akira, LockBit, Qlocker) to stopransomware.gov, ic3.gov, walla noddu CISA e 1-844-Say-CISA (1-844-729-2472).
• Centre Kanadaa ngam Kisal Siber & RCMP: Ciimtol to cyber.gc.ca (1-833-CYBER-88) walla Centre Kanadaa ngam haɓaade fenaande.
• Dental Dowlaaji Dentuɗi:
• Serwisuuji cafrirɗi: Noddu 999 (mala 101 wonande polis mo wonaa emergency).
• Fooyre Golle & NCSC: Habrirde geɗe ransomware to actionfraud.police.uk walla noddu 0300 123 2040 (24/7 liggey keɓe siber gonɗe e nguurndam). Feddeeji tokoosi e balle ina mbaawi jokkondirde e Jaabawol NCSC e Kewuuji Siber (ncsc.gov.uk) damal.
• Dental Orop:
• Serwisuuji cafrirɗi: Noddu 112 e nder denndaangal leyɗeele jeyaaɗe e UE.
• Centre Europol Oropnaare ngam haɓaade bonanndeeji e nder internet (EC3) & NoMoreRansom.org: Ƴeewto nomoreransom.org (ko Polis ngenndiijo Holanndee, Europol, e gollorɗe gollondirɗe toppitii ɗum) ngam nanngude jokkorgal ransomware NAS, e humpitaade CSIRT ngenndi maa e njuɓɓudi reende dokke (DPA e nder waktuuji 72 so tawii dokke neɗɗo ɗee njuppaama walla majjii e les GDPR).
• Ostarali e Nuwel Selannde:
• Serwisuuji cafrirɗi: Noddu 000 to Ostarali walla 111 to leydi Nuwel Selannde.
• Nokku kisal siber to Ostarali (ACSC): Noddu laylaytol renndo 24/7 e 1300 CYBER1 (1300 292 371) walla ciimtol to cyber.gov.au.
• CERT NZ: Ciimtol to cert.govt.nz.
• Inndo e Asii-Pacifik:
• Inndo (CERT-In & Laylaytol ballal ngam bonanndeeji nder internet): Noddu 1930 walla ciimtol to cybercrime.gov.in e incident@cert-in.org.in.
• Taywan (TWCERT/CC, juɓɓule galle PSIRT Synology, QNAP, e Asustor): Neldu tikketuuji keɓe kisal yeeyooɓe to PSIRT QNAP (service.qnap.com) walla PSIRT Sinoloji (synology.com/en-global/security/advisory).

Naamne keewɗe naamneede¶

Hol no ransomware heɓiri QNAP am walla Synology NAS am nde mi meeɗaa ɓuuɓnude hay jokkorde phishing gooto, ordinateeruuji am ina laaɓi haa laaɓi?¶

NAS maa ina wondi e internet renndo tawa a meeɗaani meemde ordinateeruuji maa. So tawii ko router internet maa ina joginoo UPnP (`Universal Plug and Play`) enabled (ina addana NAS "Konfiguraasiyoŋ router oto / EZ-Internet / myQNAPcloud" udditaade portooji e nder deeƴre 8080, 443, 5000, 5001, mala 22 e dow firewall maa), walla a neldii porto e junngo maa ngam naatde e piille maa e woɗɗude. Botnets otomaatik ina njokki e ƴeewndaade kala adrees IP renndo e nder internet e huutoraade ŋakkeende nde patch mum alaa walla nde alaa semmbe gardiiɗo konte kuutorteeɗe e jokkorɗe web NAS peeñɗe.

Hol no mbaawirmi anndude so tawii ransomware oo dogiino to bannge NAS OS am vs. e dow gooto e ordinateeruuji am Windows dow share reso?¶

Ƴeewee kollitooje tati : Ko adii fof, so tawii ko... Ekran naatgol njuɓɓudi web NAS e hoore mum lomtinaama e ɓataake ranndo (hono Bolt maayɗo), walla so tawii ko NAS tan jogii piille sifirteeɗe tawa kala ordinateer gonɗo e lowre maa ina laaɓi, malware oo huutortee ko e nder NAS Linux OS. Ɗiɗaɓere, uddita... NAS Jokkondiral Log / SMB Fiilde Log (e nder Sinoloji Catal Log walla QNAP Catal QuLog): so a yiyii adrees IP LAN nokkuure (hono 192,168,1,24) waɗde ujunnaaje ujunnaaje rapid Winndu / Innde / Mumtu golle dow SMB, ndeen ordinateer at 192,168,1,24 woni kaɓirgal gonngal e ñawu nguu siifde NAS maa e dow lowre ndee.

Ko waɗi waɗi DeadBolt siifde tan ko fuɗɗoode piille am mawɗe wideyoo walla domen, kadi mbele miɗo waawi fiyde walla feewnude piille sifirteeɗe feccere?¶

Ngam siifde sappooji terabytes e nder defterdu NAS hade joom mum teskaade diskiiji ɗii ina njuppa e ɓuuɓde fiilngo ngoo, strains like Bolt maayɗo tan ko siifde ko 512 kiloobayt gadano (`524,288 bytes`) e kala fiilngo e ɓeydude heen .maayɗo extension, accude gigabayteeji keddiiɗi ɗii e fiilngo ngoo memotaako e binndol laaɓtungol. So tawii majjude 512 KB gadano oo ina halka binndanɗe tokoose e fotooje JPEG haa laaɓa cer, fiiluuji wideyooji mawɗi gigabayteeji keewɗi (`.mp4`, `.mov`, `.mkv`), nate kameraaji raw, e won e nate disko masiŋ wirto (`VMDK`/`VHDX`) walla lowre SQL ina heewi feewnireede e ƴettude hoore konte moƴƴe (`moov` atom) ummoraade e wideyoo goɗɗo ƴettaaɗo e kamera gooto kuutortooɗo kuutorɗe hono untrunc.

Ko Sinoloji QuickConnect walla myQNAPcloud Link safe ngam yaltude ina softina so mi muumtii router UPnP e Port Forwarding?¶

E router UPnP e jokkondire porto junngo ɓuuɓnaama haa laaɓi, sarwisaaji jokkondire yaltuɗe hono Synology Relay Jokkondiral Jaawngal e Jokkorde ruulde amQNAP ɓuri kisal no feewi e portooji WAN udditiiɗi sabu ɗi udditataa portooji heɗtooji e firewall router maa. Kono, haa jooni eɓe peeñnina ekran maa naatnugol NAS (`DSM` / `QTS` web authentification handler) e kala gannduɗo walla teskaaɗo maa `QuickConnect ID`. Ngam kisal ɓurngal mawnude, softin jokkondiral relay renndo e jokkorde admin e huutoraade Wutte walla VPN gardiiɗo kaɓirɗe e nokku mum, ko ɗum naamnii seedantaagal kaɓirgal kriptogaraafi ko adii packet HTTP gooto ina waawi yettaade hay serveer web maa NAS.

Mbele mi yoɓa njoɓdi Bitcoin ngam DeadBolt, Qlocker, mala eCh0raix so mi alaa backups e mi alaa fotooje?¶

Laabi toppitiiɗi sariya (`FBI`, `CISA`, `Europol`, `NCSC`) ina wasiyoo no feewi yoɓde njoɓdi sabu yoɓde ina yoɓa sinndikaaji bonɗi, tee alaa ko jogori waɗde so wonaa wonde binndol otomaatik ngol ñaawoowo oo huutortoo ngol ina waawi golloraade tawa bonnaani fiiluuji ɗii. Ko adii nde meeɗaa miijaade yoɓde: (1) Natal walla hisnude diskiiji ɗii mbele aɗa waasa bonnude geɗe ɗee, (2) Ƴeewto **`nomoreransom.org`** e **`deadbolt.responders.nu`** ngam ƴeewde so tawii reennooɓe sariya ɓee nanngii tawo coktirgal mawngal ngam strain maa, (3) Ngam **`Qlocker`**, dogga **`PhotoRec` / `QRescue`** e dow nokku disko mo rokkaaka (mo heewi heɓtude 60% haa 90% e asliiji mumtaaɗi ɗii tawa ko e njoɓdi), e (4) Ngam mawɗo `.mp4`/`.mov` wideyooji hit e sifirde feccere-hoore, jarribo hoore mahngo e `untrunc`.

Ardiiɓe jokkondirɓe¶

• Malware, ransomware, e mboros spyware : jogaade e safrude ko yaawi
• Kisal routeruuji cuuɗi e kaɓirɗe IoT
• NAS RAID array bonnaama, diisnondiral keewngal ŋakki, e ZFS/Btrfs ƴellitii
• Backups ordinateeruuji, peeje 3-2-1, e ƴellitgol musiiba
• Zero-day huutoraade patching emergency e joofnirde-nguurndam kaɓirɗe isolation
• Limooje emergency e leydi

Fuɗɗoode e ardorde laawɗunde¶

• Waɗde kisal siber e kisal gollorɗe (CISA) & Biro Fedde Ngenndiije Dentuɗe (FBI) (StopRansomware.gov): Jeertinaango e dow desorɗe jokkondirɗe e Reso (NAS) Kuutorɗe ɗe DeadBolt, Qlocker, eCh0raix, e Akira ransomware njiylotoo.
• Europol nokku Oropnaajo ngam haɓaade bonanndeeji e nder internet (EC3) & Polis leydi Hollande (Politie) (NoMoreRansom.org): Golle DeadBolt ƴettugol kaɓirɗe, defterdu eCh0raix, e laabi ngam ustude ransomware.
• Goomu jaabawol keɓe kisal geɗe QNAP (QNAP PSIRT) & Yiilirde toppitiinde kisal Synology: Bulletins karallaagal ko faati e ustude router UPnP, heɓtude konsoleeji admin gonɗi e njiimaandi, QRescue (PhotoRec) Restoraaji ɗi ndokkaaka, e Waɗde ko waylaaka WORM Fotooji.
• Nokku ngenndiijo kisal siber (NCSC) (Dental Dowlaaji Dentuɗi): Ustugol Malware e Ransomware e dow lowre e kuutorɗe birooji tokoosi.