Ransomware sou yon kay oswa biwo NAS (Synology/QNAP): Sispann chifreman ak ekspoze UPnP¶

Tande disk di yo andedan depo ki konekte nan rezo ou a (NAS) aparèy (Synology DiskStation, QNAP Turbo NAS, TrueNAS, Asustor, TerraMaster, oswa Western Digital My Cloud) thrashing kontinyèlman nan 100 pousan itilizasyon disk pandan y ap pataje dosye ranpli ak .deadbolt, .ech0raix, .qlocker, .7z, .lockbit, oswa .encrypt file extensions (or seeing your NAS web login screen replaced by a Bitcoin ransom demand) is a critical storage emergency. NAS appliances are prized targets for automated internet-wide ransomware botnets (DeadBolt, Qlocker, eCh0raix / QNAPCrypt, AgeLocker, Chatterbox, ak Akira) because a single unpatched NAS often holds 10 to 100 terabytes of a family's or small business's entire digital life and is frequently exposed directly to the public internet without the owner realizing it via Router UPnP (Universal Plug and Play) Auto-Port-Forwarding or vendor cloud-relay services (myQNAPcloud, Synology QuickConnect, EZ-Internet). Before you yank the AC power cord out of the wall, you must make a crucial 10-second architectural decision based on whether your NAS uses Copy-on-Write snapshots (Btrfs oswa ZFS) or a traditional RAID array; for non-ransomware disk array crashes, consult NAS RAID array degraded, multiple drive failure, and ZFS/Btrfs recovery, and for PC-based ransomware infections, see malware, ransomware, and spyware infection as well as securing home routers and IoT devices. If the ransomware impacts hospital operations, municipal emergency services, or physical safety infrastructure, call your local emergency number (911 nan Etazini ak Kanada, 112 atravè Inyon Ewopeyen an, 999 in the United Kingdom) or consult our directory of international nimewo ijans.

Fè sa kounye a¶

1. Pull the physical Ethernet (RJ45 / 10GbE) network cable(s) out of the back of the NAS RIGHT NOW, before touching the power cord:
2. Unplugging the Ethernet cable(s) immediately severs the attacker's interactive SSH/HTTP command-and-control session, stops the NAS from downloading secondary encryption payloads, and, equally important, instantly stops an infected desktop PC on your local office LAN from encrypting your NAS over SMB/CIFS network shares (\\NAS\Share).
3. Determine in 15 seconds whether to cut power or halt the encryption process cleanly:
4. Scenario A: The ransomware is running ON a desktop PC on your LAN and encrypting NAS files over an SMB/Mapped Network Drive: Simply pulling the NAS Ethernet cable in Step 1 already stopped 100% of the encryption on the NAS. Leave the NAS powered on so its RAID array and filesystem remain clean, and go isolate the infected Windows/Mac workstation.
5. Scenario B: The ransomware binary is executing directly INSIDE the NAS Linux operating system itself (DeadBolt, Qlocker, eCh0raix)*:
   • If you do not have Btrfs oswa ZFS snapshots enabled (for example, an older ext4 volume) and the drives are actively grinding as the NAS encrypts your only copy of the files, press and hold the physical front Power Button on the NAS for 5 to 10 seconds to force an immediate hard power-off (or pull the DC/AC power plug if the button is unresponsive). Every minute the NAS stays powered on lets its CPU encrypt another 5 to 20 gigabytes of your files.
   • Important caveat (Why DeadBolt & Qlocker victims must NOT reboot after recovery): Ransomware strains like Qlocker (which moves files into password-protected .7z archives using 7z) ak DeadBolt sometimes keep active encryption state or decryption keys in /tmp (RAM) or hijack the web UI binary (/home/httpd/index.html). If you still have an open local SSH root shell into the NAS, check ps aux epi /tmp before powering off (see Phase 2 below).
6. Log into your internet router / firewall (192.168.1.1 / 192.168.0.1 / UniFi / pfSense / ISP gateway) immediately and turn OFF UPnP (Universal Plug and Play) AND delete all WAN Port Forwarding rules pointing to your NAS:
7. Over 80 percent of home and small-office NAS ransomware infections happen because the user clicked "Auto Router Configuration / EZ-Internet / UPnP" during initial setup, which silently instructed the home router to open TCP ports 5000, 5001, 8080, 8443, 443, 22 (SSH), or 445 (SMB) directly to the entire public internet (Shodan.io / Censys).
8. Disable UPnP permanently in your router's WAN/NAT settings and delete every port-forwarding rule pointing to the NAS's local IP address.
9. Do NOT initialize, reformat, or run "Reset / Reinstall DSM or QTS" on the hard drives before inspecting whether the ransomware hijacked only the OS partition or the data volume:
10. In attacks like DeadBolt, the malware overwrites the NAS web login page (index.html) to display a full-screen ransom note blocking access to the QNAP/Synology admin dashboard, even when your underlying Btrfs / ZFS snapshots oswa gwo dosye videyo (plis pase 20 megabyte) yo toujou 100 pousan entak sou kondui yo.
11. Tcheke si NAS ou genyen Btrfs (Synology Snapshot Replication), ZFS (TrueNAS / QuTS hero), oswa LVM Snapshots nivo blòk (QNAP Storage & Snapshots)*:
12. Paske Btrfs epi ZFS snapshots yo lekti sèlman nan kouch blòk sistèm fichye a (ak Synology WORM / Immuable Snapshots pa menm ka efase pa yon konpwomèt root kont admin), ou ka souvan refè 100 pousan nan dosye pataje ankripte ou yo nan 60 segonn ak zewo pèt done ak zewo ranson peye.
13. Avan ou peye nenpòt ranson, idantifye egzak ransomware souch la lè l sèvi avèk ID Ransomware (id-ransomware.malwarehunterteam.com) ak No More Ransom (nomoreransom.org)*:
14. Plizyè gwo tansyon ransomware NAS (eCh0raix / QNAPCrypt, byen bonè Qlocker via photorec / qrescue ekstraksyon boutèy demi lit, Muhstik, ak SynoLocker) gen decrypteurs piblik gratis oswa metòd legal pou fè ekstraksyon kle ki pibliye pa lapolis ak chèchè sekirite yo.

Pyebwa desizyon: imedya NAS ransomware triyaj ak chemen rekiperasyon¶

Sèvi ak workflow sa a pou detèmine si atak la soti nan yon òdinatè LAN oswa dirèkteman sou NAS la, epi chwazi metòd rekiperasyon ki pi an sekirite:

flowchart TD
    Symptom["NAS Drive Manje nan 100% + Fichye yo chanje non (.deadbolt, .7z, .ech0raix, .lockbit) oswa entènèt UI montre ekran ranson"] --> PullLAN["ETAP 1 (Nan 5 segonn): Deploge tout kab Ethernet ki soti nan do NAS la"]

    PullLAN --> SourceCheck{"Èske chifreman te sispann enstantane ou te deploge kab Ethernet NAS la?"}

    SourceCheck -->|"WI: Aktivite Disk tonbe a zewo lè LAN dekonekte"| SMBVector["SOUS A: Ransomware ap kouri sou yon PC Windows/Mac sou rezo w epi ankripte dosye pataje sou SMB"]

    SourceCheck -->|"NON: Disk dis NAS yo kontinye bat ak Ethernet dekonekte (oswa paj NAS pou konekte sou entènèt la li menm te ranplase pa ekran ranson)"| DirectNAS["SOUS B: Ransomware binè ap egzekite dirèkteman andedan eksplwatasyon NAS la (eksploite atravè UPnP / Pò WAN ekspoze 5000, 5001, 8080, 443, 22)"]

    SMBVector --> IsolatePC["Jwenn & Dekonekte PC ki enfekte a sou LAN ou -> Retabli Dosye Pataje NAS Soti nan Snapshots Btrfs / ZFS / QNAP oswa Hyper Backup"]

    DirectNAS -->SSHCheck{"Èske w gen yon sesyon SSH lokal aktif ouvè (oswa èske se Qlocker k ap kouri 7z)?"}

    SSHCheck -->|"Wi (Qlocker / Pwosesis aktif 7z)"| GrabPass["Enspekte ps aux | grep 7z sou SSH pou kaptire modpas Plaintext 7-Zip soti nan liy lòd Args anvan yo touye pwosesis"]
    SSHCheck -->|"Pa gen SSH / Enkoni souch Manje Disk"| PowerOff["Kenbe bouton NAS Power 5-10 segonn pou fòse imedyat Hard Power-Off pou fichye ki pa kode ak espas gratis yo konsève."]

    GrabPass --> KillUPnP["ETAP 2: Konekte sou routeur -> Enfim UPnP pou tout tan + Efase tout Règ Transmisyon Port (5000, 5001, 8080, 443, 22)"]
    PowerOff --> KillUPnP
    IsolatePC --> KillUPnP

    KillUPnP --> RecoveryPath{"Ki Byen Rekiperasyon ki egziste sou NAS la?"}

    RecoveryPath -->|"Btrfs / ZFS / QNAP Block Snapshots Prezante"| SnapRestore["Netwaye OS patisyon / Mizajou mikrolojisyèl -> Retounen Dosye Pataje pou Pre-Atak Snapshot"]
    RecoveryPath -->|"Ekstèn USB / Sovgad Cloud Offsite (Hyper Backup / HBS 3)"| BackupRestore["Siye & Rebati NAS sou patched Firmware -> Retabli Soti nan Offline/Nwaj sovgad"]
    RecoveryPath -->|"Pa gen Snapshots & Pa gen sovgad"| ForensicCarve["Klonaj Drive-Lekti Sèlman -> Tcheke NoMoreRansom.org + Kouri PhotoRec / QRescue Sculpsyon ki pa Alokasyon (Espesyalman efikas kont Qlocker)"]

Ki jan NAS Ransomware kraze: de vektè atak yo¶

Anvan ou konekte NAS ou a tounen nan switch rezo lokal ou a, ou dwe konnen kilès nan de vektè yo antre konplètman diferan pèmèt ransomware la sou komèsan depo ou yo:

Faz 1: Fèmen Ekspozisyon Entènèt la (Router UPnP, Port Forwarding, and Cloud Relays)¶

Si ou netwaye oswa restore NAS ou san ou pa fèmen twou rezo a sou routeur ou a, botne otomatik ki analize adrès IP piblik ou a pral re-enfekte NAS la nan kèk èdtan apre yo pote l sou entènèt. Konplete fèmen rezo sa a sou routeur ou an premye:

1. Konekte nan Routeur Entènèt ou / Firewall Admin Console:
2. Louvri yon navigatè sou yon òdinatè oswa telefòn pwòp epi ale nan IP pòtay routeur ou a (anjeneral 192.168.1.1, 192.168.0.1, 10.0.0.1, oswa atravè app routeur may ou tankou UniFi, Eero, Google Home, TP-Link Deco, ASUS Router, Netgear Nighthawk).
3. Disable UPnP (Universal Plug and Play) Permanently:
4. Navige nan Avanse> NAT Forwarding / WAN / Rezo> UPnP epi aktive UPnP a OFF / Enfim.
5. Poukisa UPnP tèlman danjere pou pwopriyetè NAS: Lè UPnP aktive sou routeur ou a, nenpòt aparèy sou rezo lokal ou a (tankou sòsye "EZ-Internet" oswa "Auto Router Configuration" NAS ou a, oswa malveyan sou yon televizyon entelijan) ka voye an silans. IGD (Internet Gateway Device) mande nan routeur ou a ki di "Louvri pò WAN ekstèn 8080 ak 5001 sou IP lokal mwen an 192.168.1.50", kontoune firewall ou san yo pa janm mande modpas routeur ou.
6. Efase tout Manyèl Port Forwarding (Virtual Server) & DMZ Règ ki montre NAS:
7. Go to Advanced > NAT Forwarding > Port Forwarding (or Virtual Servers) and delete every rule forwarding TCP or UDP ports (80, 443, 5000, 5001, 8080, 8443, 21 FTP, 22 SSH, 873 rsync, 445 SMB, 32400 Plex if unneeded) to your NAS IP.
8. Check Advanced > DMZ and verify that DMZ Host is Disabled (placing a NAS IP in a router's DMZ exposes all 65,535 TCP and UDP ports of the NAS directly to the public internet).
9. Verify from Outside Your Network That Zero NAS Ports Are Open:
10. Visit shodan.io oswa grc.com (ShieldsUP) or run a port scan against your public WAN IP address to confirm that ports 5000, 5001, 8080, 8443, 443, ak 22 now return Filtered / Stealth / Closed.

Phase 2: Strain-Specific Emergency Triage (Qlocker, DeadBolt, eCh0raix)¶

Before you wipe the NAS or pay a ransom, check which specific NAS ransomware strain hit your device. Each major NAS family has unique technical weaknesses that allow partial or total data recovery without paying:

1. If Your Files Were Replaced with .7z Archives (Qlocker on QNAP / Linux NAS)¶

How Qlocker works: Instead of writing a custom cryptographic engine, Qlocker kouri yon script ki envoke pwòp entegre NAS la 7-Zip (/usr/local/sbin/7z) binè pou konprese chak dosye nan yon modpas ki pwoteje .7z achiv ak Lè sa a, kouri nòmal Linux rm (unlink) sou dosye orijinal la. - ** Triy Trick #1 (Pran modpas la ap viv nan ps aux Anvan Éteindre)**: Si Qlocker se kounye a toujou ap kouri sou NAS ou epi ou ka konekte lokalman via SSH (ssh admin@nas-local-ip), kouri lòd sa a imedyatman anvan etenn:

ps aux | grep 7z

2. Si ekran Login NAS ou a te ranplase pa DeadBolt Paj Ranson (.deadbolt dosye)¶

How DeadBolt travay: 1. DeadBolt ranplase /home/httpd/index.html (oswa /home/httpd/cgi-bin/index.cgi) ak pwòp paj binè/HTML li ki detounen navigatè entènèt ou a chak fwa ou eseye louvri tablodbò QNAP QTS / Asustor ADM, pou mande Bitcoin an echanj pou yon kle dechifre mèt 32-hex-karaktè (livre atravè yon Bitcoin sou chèn). OP_RETURN tranzaksyon). 2. Ki jan ou ka reprann aksè a QNAP QTS / QuTS ewo Admin Dashboard ou san ou pa pèdi done ou yo: - Opsyon A (Via SSH lokal si li aktive): SSH nan NAS lokalman (ssh admin@<nas-ip>), sispann koken an deadbolt pwosesis si w ap kouri, epi kouri script ofisyèl rekiperasyon firmwèr QNAP a oswa restore orijinal la /home/httpd/index.html soti nan imaj la ROM sistèm lekti sèlman (/mnt/HDA_root/update_pkg/). - Opsyon B (Flash Firmware San Disk + Reinsertion Hot-Plug): 1. Etenn NAS la. 2. Glise tout disk di yo deyò pa 2 santimèt (1 pous) pou yo dekonekte nan backplane la (numere lòd bay yo ak anpil atansyon ak kasèt pent an premye). 3. Limen NAS san kondui difisil yo, jwenn IP li yo atravè Qfinder Pro, lè yo mande sou ekran konfigirasyon an, konekte kondui yo tounen nan baie egzak yo, epi chwazi "Mizajou mikrolojisyèl sèlman (Kenbe tout done ak paramèt)" (pa janm klike sou "Inisyalize sistèm", ki siye kondui yo). 3. Enpòtan Remak Decryptage Lapolis sou DeadBolt: Nan operasyon kowòdone ki te dirije pa Polis Nasyonal Olandè (Politie), Europol (No More Ransom), ak Responders.nu, lapolis te twonpe avèk siksè DeadBolt aktè menas yo pandan yon frè mempool te ogmante nan lage plis pase 150 kle dechifre mèt anvan tranzaksyon Bitcoin ki pa koute chè atakè yo te anile atravè Replace-By-Fee. Tcheke deadbolt.responders.nu epi nomoreransom.org pou wè si espesifik ou DeadBolt kle adrès viktim yo te kaptire pa lapolis.

3. Si fichye ou yo fini nan .encrypt (eCh0raix / QNAPCrypt)¶

• Plizyè jenerasyon nan eCh0raix (QNAPCrypt) te itilize defo AES kle derivasyon oswa te gen kòmand-ak-kontwòl yo (C2) baz done sezi pa chèchè sekirite ak lapolis.
• Visit nomoreransom.org epi telechaje de fichye chiffres (oswa nòt ranson an README_FOR_DECRYPT.txt) pou teste gratis Bitdefender / NoMoreRansom eCh0raix Decryptor anvan ou siye anyen.

Faz 3: Retabli dosye ou soti nan Btrfs, ZFS, oswa QNAP Snapshots nan 60 segonn¶

Si Vektè # 2 (yon PC ki enfekte ak ransomware sou NAS ou a te ankripte NAS ou a sou dosye pataje sou SMB), oswa si ou te gen Imuyab (WORM) Snapshots oswa intact LVM/Btrfs/ZFS Snapshots pandan yon atak dirèk NAS, ou ka retabli 100 pousan nan dosye ou imedyatman:

1. Synology DiskStation (DSM 7.x avèk Btrfs Replikasyon snapshot)¶

1. Premyèman, verifye ke PC ki enfekte sou LAN ou a dekonekte nan rezo a, epi mete ajou Synology DSM nan dènye lage anba Kontwòl Panel> Mizajou & Restore.
2. Louvri pake Snapshot Replication anndan Synology DSM.
3. Klike sou Recovery nan bò gòch la.
4. Chwazi Dosye Pataje chiffres la (oswa iSCSI LUN) epi klike sou Reprann.
5. Navige lis snapshots pwograme yo (GMT+...) epi chwazi snapshot yo te pran touswit anvan chifreman ransomware la te kòmanse (tcheke Aksyon > Browse premye pou w previsualize fichye ki andedan snapshot sa a epi konfime yo pwòp epi yo pa kode).
6. Klike sou Aksyon > Retabli nan snapshot sa a (oswa Klonaj ak yon nouvo non si ou vle kenbe katab ki chiffres la intact pou prèv legal pandan w ap monte imedyatman yon kopi pwòp nan katab la pataje).
7. Paske Btrfs se yon kopi-sou-ekri (CoW) sistèm fichye, woule tounen yon katab pataje 20-terabyte nan yon snapshot pre-atak pran mwens pase 10 segonn.

2. QNAP NAS (QTS Snapshots LVM nivo blòk & QuTS hero ZFS Snapshots)¶

1. Yon fwa ke ewo QTS/QuTS patched epi izole nan WAN a, louvri Depo ak Snapshots.
2. Ale nan Depo > Depo/Snapshots, chwazi Volim Epè, Volim Mens, oswa Dosye pataje ZFS ki afekte ou a, epi klike sou Manadjè Snapshot (ikòn kamera a).
3. Chwazi dènye snapshot pwòp yo te pran anvan timestamp atak la.
4. Navige pye bwa katab ki andedan fenèt dwat la pou verifye dosye ou yo entak, apresa klike sou Retounen snapshot volim (oswa chwazi tout dosye epi klike sou Restore pou ranplase sèlman fichye ki chiffres yo).

3. TrueNAS (CORE / SCALE sou ZFS) ak Unraid (ZFS / Btrfs)¶

• **Sou TrueNAS (ZFS(tank/share@auto-2026-10-31_12-00), epi klike sou Rollback (oswa klonaj snapshot la nan yon nouvo seri done zfs clone tank/share@auto-2026-10-31_12-00 tank/share_recovered konsa ou pa janm pèdi nouvo snapshots entèmedyè).

Faz 4: Redi NAS ou a pou li pa janm ka chifre ankò (Lis 7 pwen an)¶

Yon fwa done ou yo refè, aplike sèt règ konfigirasyon obligatwa sa yo sou aparèy Synology, QNAP, TrueNAS, oswa Asustor ou anvan ou rekonekte li nan rezo a:

• 1. Pa janm voye nenpòt pò sou routeur ou a nan NAS ou a: Sèvi ak Tailscale oswa WireGuard VPN Olye de sa:
• Enstale pake ofisyèl Tailscale ki soti nan Synology Package Center / QNAP App Center (oswa kouri WireGuard VPN Server ki entegre routeur ou a).
• Tailscale kreye yon konfigirasyon zewo, kanmarad-a-kanmarad WireGuard chifre tinèl may (100.x.y.z) ant telefòn ou, laptop ou, ak NAS ou avèk zewo pò louvri sou firewall routeur lakay ou. Ou ka jwenn aksè nan foto NAS ou, fichye, ak ekran admin soti nan nenpòt kote nan mond lan pandan y ap NAS ou rete 100% envizib nan eskanè entènèt tankou Shodan.
• 2. Enfim Default entegre a admin Kont ak Kreye yon Administratè Customize Non ak Obligatwa 2FA:
• Tou de Synology DSM ak QNAP QTS anbake ak yon kont default ki rele admin (UID 1024 oswa UID 0). Otomatik robo fòs brital mato non itilizatè a admin 24/7.
• Kreye yon nouvo kont administratè ak yon non itilizatè inik, konekte ak nouvo kont sa a, ale nan Kontwòl Panel> Itilizatè & Gwoup (oswa Itilizatè yo), ak Enfim default la. admin kont.
• Aktive Otantifikasyon 2 faktè obligatwa (OTP / Passkey / Approve Sign-in) pou tout kont administratè yo.
• 3. Aktive Immuabl (WORM) Snapshots (7-to-14-Day Retention Lock)*:
• Sou Synology DSM 7.2+: Louvri Snapshot Replication > Snapshots > Settings > Schedule, aktive snapshots chak jou, epi tcheke "Pèmèt snapshots immuabl" ak yon peryòd pwoteksyon de 7 a 14 jou. Menm si yon pirat vòlè modpas rasin ou oswa eksplwate yon vilnerabilite nwayo nan DSM, pèsonn (pa menm root) ka efase yon Snapshot Immutable jiskaske revèy pyès ki nan konpitè 7 jou ekspire.
• Sou QNAP QuTS ewo / QTS: Konfigure yon Snapshot Replica Vault oswa aktive WORM (Write Once, Read Many) règleman retansyon sou pataje backup kritik, epi asire w ke "Rezève Espas Snapshot" aktive.
• 4. Limite otorizasyon pataje rezo SMB (Least Privilege) Se konsa, yon enfeksyon Laptop pa ka ankripte tout NAS la:
• Pa janm kat mèt NAS ou a admin kalifikasyon yo andedan Windows File Explorer (\\NAS\) sou laptops chak jou.
• Kreye yon kont itilizatè estanda ki pa admin pou aksè nan dosye chak jou, epi mete dosye achiv/foto ou (pa egzanp, 2010-2025 Family Photos Archive) pou Lekti sèlman (ro) pou itilizatè Desktop chak jou pou si PC Windows yon manm fanmi an trape ransomware, PC a ka li dosye sa yo men pa ka ankripte oswa modifye yo.
• 5. Aktive firewall entegre NAS la (Allow LAN + Tailscale Subnets Only) & Auto-Bloke:
• Anndan Synology Control Panel> Sekirite> Firewall (oswa QNAP QuFirewall), kreye yon règ lis otorize strik ki pèmèt koneksyon sèlman nan sous-rezo LAN lokal ou a (192.168.1.0/24) ak sou-rezo Tailscale/VPN ou a (100.64.0.0/10), ki te swiv pa yon règ anba yo mete nan Refize tout. Menm si yon moun aksidantèlman vire UPnP tounen sou nan routeur la, pwòp filtè pake entèn NAS la pral lage chak pake entènèt piblik imedyatman.
• 6. Enfim SSH (Port 22) ak Telnet (Port 23) Lè pa Aktivman Depanaj:
• Kite SSH vire OFF andedan Kontwòl Panel > Tèminal & SNMP pandan operasyon nòmal chak jou; sèlman aktive li sou pou 10 minit ou bezwen kouri yon travay liy lòd, Lè sa a, vire l 'dwa tounen.
• 7. Kenbe yon Vrè "3-2-1" Air-Gapped / Immuabl Cloud Backup (Hyper Backup / HBS 3)*:
• Swiv nou sovgad òdinatè ak 3-2-1 gid rekiperasyon dezas: konfigirasyon Synology Hyper Backup oswa QNAP Hybrid Backup Sync (HBS 3) pou pouse sovgad deduplike kwode chak swa, bò kliyan nan yon disk di USB ekstèn ke ou fizikman deploge oswa nan yon objè-bloke (S3 Object Lock Compliance Mode) bokit nwaj (Backblaze B2, Wasabi, oswa AWS S3) lè l sèvi avèk restriksyon kle API ajoute sèlman.

Nimewo ijans rejyonal yo ak pwotokòl ajans yo¶

Ajans nasyonal sibèrkrim atravè lemond envestige atak ransomware ki vize aparèy NAS yo, ki kenbe depo kle dechifre sezi yo (No More Ransom) epi swiv enfrastrikti kriminèl:

• Etazini ak Kanada:
• Ijans pann sekirite lavi: Rele 911 si ransomware deranje swen sante oswa sistèm sekirite fizik yo.
• CISA & FBI Entènèt Sant Plent Krim (IC3): Rapòte kanpay ransomware NAS (DeadBolt, Akira, LockBit, Qlocker) nan stopransomware.gov,ic3.gov, oswa rele CISA nan 1-844-Say-CISA (1-844-729-2472).
• Canadian Center for Cyber ​​Security & RCMP: Rapò nan cyber.gc.ca (1-833-CYBER-88) oswa Canadian Anti-Fraud Centre.
• Wayòm Ini:
• Sèvis Ijans: Rele 999 (oswa 101 pou polis ki pa ijans).
• Aksyon Fwòd & NCSC: Rapòte ensidan ransomware nan actionfraud.police.uk oswa rele 0300 123 2040 (liy ensidan cyber ap viv 24/7). Ti biznis ak òganizasyon charitab yo ka konsilte NCSC Cyber ​​Incident Response (Repons Ensidan Cyber ​​NCSC)ncsc.gov.uk) Portal.
• Inyon Ewopeyen an:
• Sèvis Ijans: Rele 112 atravè tout eta manm Inyon Ewopeyen yo.
• Europol European Cybercrime Center (EC3) & NoMoreRansom.org: tcheke nomoreransom.org (Konsève pa Polis Nasyonal Olandè, Europol, ak ajans patnè) pou sezi kle dechifre ransomware NAS, epi rapòte bay CSIRT nasyonal ou ak Otorite Pwoteksyon Done yo (DPA nan lespas 72 èdtan si done pèsonèl yo te eksfiltre oswa pèdi anba GDPR).
• Ostrali ak Nouvèl Zeland:
• Sèvis Ijans: Rele 000 nan Ostrali oswa 111 nan Nouvèl Zeland.
• Sant Sekirite Sibèr Ostralyen (ACSC): Rele liy dirèk ransomware 24/7 nan 1300 CYBER1 (1300 292 371) oswa rapòte nan cyber.gov.au.
• CERT NZ: Rapò nan cert.govt.nz.
• Lend ak Azi-Pasifik:
• ** Lend (CERT-In & Liy Asistans Cyber ​​Crime)**: Rele 1930 oswa rapòte nan cybercrime.gov.in ak incident@cert-in.org.in.
• Taiwan (TWCERT/CC, jiridiksyon lakay Synology, QNAP, ak Asustor PSIRTs): Soumèt tikè ensidan sekirite vandè yo dirèkteman nan QNAP PSIRT (service.qnap.com) oswa Synology PSIRT (synology.com/en-global/security/advisory).

Kesyon yo poze souvan¶

Ki jan ransomware enfekte QNAP mwen oswa Synology NAS mwen lè mwen pa janm klike sou okenn lyen èskrokri epi òdinatè mwen yo konplètman pwòp?¶

NAS ou a te enfekte dirèkteman nan entènèt piblik la san yo pa manyen òdinatè w yo. Swa routeur entènèt ou te genyen UPnP (`Universal Plug and Play`) pèmèt (pèmèt karakteristik "Auto Router Configuration / EZ-Internet / myQNAPcloud" NAS la pou louvri pò an silans 8080, 443, 5000, 5001, oswa 22 sou firewall ou), oswa ou manyèlman voye yon pò pou jwenn aksè nan dosye ou adistans. Otomatik botne kontinyèlman analize chak adrès IP piblik sou entènèt la epi eksplwate frajilite ki pa patch oswa ki fèb admin modpas sou entèfas entènèt NAS ekspoze.

Kouman mwen ka konnen si ransomware la te kouri dirèkteman andedan eksplwatasyon NAS mwen an vs sou youn nan òdinatè Windows mwen yo sou yon rezo pataje?¶

Gade nan twa endikatè: Premyèman, si la Ekran login administrasyon entènèt NAS tèt li te ranplase pa yon nòt ranson (tankou DeadBolt), oswa si sèlman NAS la gen dosye chiffres pandan tout PC sou rezo ou a pwòp, malveyan yo egzekite dirèkteman andedan OS Linux NAS la. Dezyèmman, louvri NAS Koneksyon Log / SMB File Transfer Log (nan Synology Sant Log oswa QNAP Sant QuLog): si ou wè yon adrès IP LAN lokal (tankou 192.168.1.24) fè dè dizèn de milye rapid Ekri / Chanje non / Efase operasyon yo fini SMB, Lè sa a, òdinatè a nan 192.168.1.24 se aparèy ki enfekte ki ankripte NAS ou sou rezo a.

Poukisa te fè DeadBolt sèlman ankripte kòmansman gwo videyo mwen an oswa dosye baz done, epi mwen ka toujou jwe oswa repare fichye ki pasyèlman chiffres?¶

Pou ankripte dè dizèn de teraocte nan depo NAS anvan pwopriyetè a remake disk yo ap pile epi rale ploge a, tansyon tankou DeadBolt sèlman ankripte la premye 512 kilobytes (`524,288 bytes`) nan chak fichye epi ajoute a .deadbolt ekstansyon, kite jigokte ki rete yo nan dosye a intact nan tèks klè. Pandan w pèdi premye 512 KB yo detwi ti dokiman ak foto JPEG nèt, gwo dosye videyo milti-gigaocte (`.mp4`, `.mov`, `.mkv`), pye kamera anvan tout koreksyon, ak sèten imaj machin vityèl ki gen kapasite (`VMDK`/`VHDX`) oswa baz done SQL ka souvan repare pa transplantasyon yon header veso ki valab (`moov` atom) soti nan yon lòt videyo anrejistre ak menm kamera a lè l sèvi avèk zouti tankou untrunc.

Èske Synology QuickConnect oswa myQNAPcloud Link san danje pou kite aktive si mwen fèmen routeur UPnP ak Port Forwarding?¶

Avèk routeur UPnP ak transmisyon pò manyèl fèmen nèt, sèvis relè sortant tankou Synology QuickConnect Relay epi MyQNAPcloud Link yo siyifikativman pi an sekirite pase pò WAN louvri paske yo pa louvri pò koute sou firewall routeur ou a. Sepandan, yo toujou ekspoze ekran login NAS ou a (`DSM` / `QTS` gestionnaire otantifikasyon entènèt) bay nenpòt moun ki konnen oswa devine ou `QuickConnect ID`. Pou sekirite maksimòm, enfim aksè relè piblik nan koòdone admin la epi sèvi ak Tailscale oswa WireGuard VPN olye de sa, ki mande pou otantifikasyon aparèy kriptografik anvan yon sèl pake HTTP ka menm rive nan sèvè entènèt NAS ou a.

Èske mwen ta dwe peye ranson Bitcoin pou DeadBolt, Qlocker, oswa eCh0raix si mwen pa gen okenn sovgad epi pa gen okenn snapshots?¶

Ajans ki fè respekte lalwa (`FBI`, `CISA`, `Europol`, `NCSC`) konseye fòtman pa peye ranson paske peman fon sendika kriminèl epi yo pa pote okenn garanti ke script dechifre otomatik atakè a ap travay san yo pa koripsyon dosye. Anvan ou janm konsidere peman: (1) Imajine oswa prezève kondui yo pou ou pa kapab fè bagay yo vin pi mal, (2) Tcheke **`nomoreransom.org`** ak **`deadbolt.responders.nu`** pou wè si lapolis te deja sezi kle prensipal la pou souch ou a, (3) Pou **`Qlocker`**, kouri **`PhotoRec` / `QRescue`** sou espas disk ki pa asiyen (ki souvan refè 60% a 90% orijinal yo efase gratis), epi (4) Pou gwo `.mp4`/`.mov` videyo frape pa chifreman pasyèl-header, tès rekonstriksyon header ak `untrunc`.

Gid ki gen rapò¶

• Malveyan, ransomware, ak enfeksyon espyon: imedya kenbe ak rekiperasyon
• Sekirize routeurs lakay yo ak aparèy IoT
• NAS RAID array degraded, multiple drive failure, and ZFS/Btrfs recovery
• Sovgad òdinatè, estrateji 3-2-1, ak rekiperasyon dezas
• Zewo jou eksplwate patch ijans ak izolasyon aparèy nan fen lavi
• Nimewo ijans pa peyi

Sous ak konsèy ofisyèl yo¶

• Ajans Sekirite Sibè ak Enfrastrikti (CISA) & Biwo Envestigasyon Federal (FBI) (StopRansomware.gov): Alèt sou Depo ki tache nan rezo a (NAS) Aparèy ki vize pa DeadBolt, Qlocker, eCh0raix, ak Akira Ransomware.
• Sant Ewopeyen Sibèkrim Europol (EC3) & Polis Nasyonal Olandè (Politie) (NoMoreRansom.org): Operasyon DeadBolt Key Seizures, eCh0raix Decryptor Repository, ak Ransomware Diminution Guidelines.
• Ekip Repons Ensidan Pwodui QNAP (QNAP PSIRT) & Synology Konsèy Konsiltatif Sekirite: Bilten Teknik sou Enfimite Routeur UPnP, Rekiperasyon Konsole Admin ki pitoke yo, QRescue (PhotoRec) Rekiperasyon san alokasyon, ak Pèmèt imuiabl WORM Snapshots.
• Sant Sekirite Sibè Nasyonal (NCSC) (Wayòm Ini): *Diminisyon Malveyan ak Ransomware sou Depo Rezo ak Ti Aparèy Biwo *.