Ransomware ku NAS y'Awaka oba mu Ofiisi (Synology/QNAP): Okuyimiriza Encryption n'Okubikkula UPnP¶

Okuwulira hard drives munda mu Network-Attached Storage yo (NAS) ekyuma ( ) .Synology DiskStation, . QNAP Turbo NAS, . TrueNAS, . Asustor, . TerraMaster, oba Western Digital My Cloud) okukuba obutasalako ku 100 ku buli 100 disk utilization nga folders ezigabibwa zijjula ne .deadbolt, . .ech0raix, . .qlocker, . .7z, . .lockbit, oba .encrypt okugaziya fayiro (oba okulaba screen yo ey’okuyingira ku mukutu gwa NAS nga ekyusibwamu obwetaavu bw’ekinunulo kya Bitcoin) mbeera ya mangu ey’okutereka. Ebyuma bya NAS bye bisinga okutunuulirwa ku botnets za ransomware ezikola ku yintaneeti yonna (DeadBolt, . Qlocker, . eCh0raix / . QNAPCrypt, . AgeLocker, . Chatterbox, era Akira) kubanga NAS emu etaliiko patch etera okukwata terabytes 10 ku 100 ez’obulamu bwa digito bwonna obw’amaka oba bizinensi entono era etera okulagibwa butereevu ku yintaneeti ey’olukale nga nnannyini yo tategedde ng’eyita mu Router UPnP (Universal Plug and Play) Auto-Port-Forwarding oba empeereza z'ekire-okuweereza omutunzi (myQNAPcloud, . Synology QuickConnect, . EZ-Internet). Nga tonnasika waya ya masannyalaze ga AC okuva mu bbugwe, olina okusalawo okukulu mu by’okuzimba mu sikonda 10 okusinziira ku oba NAS yo ekozesa ebifaananyi bya Copy-on-Write (Btrfs oba ZFS) oba ensengekera ya RAID ey’ennono; ku kugwa kwa disiki etali ya ransomware, weebuuze NAS RAID array ekendedde, drive eziwera, n'okuzzaawo ZFS/Btrfs, era ku yinfekisoni za ransomware ezesigamiziddwa ku PC, laba malware, ransomware, ne spyware okukwatibwa nga kwotadde ne okukuuma routers z’awaka n’ebyuma bya IoT. Singa ransomware ekosa emirimu gy’eddwaliro, empeereza ya munisipaali ey’amangu, oba ebikozesebwa mu by’okwerinda mu mubiri, kuba ku nnamba y’amangu mu kitundu kyo (911 mu Amerika ne Canada, . 112 okwetoloola omukago gwa Bulaaya, . 999 mu Bungereza) oba weebuuze ku dayirekita yaffe ey’ensi yonna ennamba z’amangu.

Kino kikole kati¶

1. Sika Ethernet ey'omubiri (RJ45 / . 10GbE) network cable(s) okuva emabega wa NAS KATI, nga tonnakwata ku waya y’amasannyalaze:
2. Okuggyamu waya (s) ya Ethernet amangu ago kisalako olutuula lw’omulumbaganyi olukwatagana olwa SSH/HTTP command-and-control session, kiyimiriza NAS okuwanula emigugu egy’okusiba egy’okubiri, era, ekikulu kyenkanyi, kiyimiriza mangu PC ya desktop erimu akawuka ku LAN ya ofiisi yo ey’omu kitundu okusiba NAS yo ku migabo gy’omukutu gwa SMB/CIFS (\\NAS\Share).
3. Salawo mu sikonda 15 oba okusalako amasannyalaze oba okuyimiriza enkola y'okusiba mu ngeri ennongoofu:
4. Ekifaananyi A: Ransomware ekola KU desktop PC ku LAN yo era ng’esiba fayiro za NAS ku SMB/Mapped Network Drive: Simply okusika cable ya NAS Ethernet mu Step 1 yayimiriza dda 100% ku encryption ku NAS. Leka NAS ng'eyaka kale RAID array yaayo ne filesystem bisigala nga biyonjo, era genda okwawula Windows/Mac workstation erimu obuwuka.
5. Ekifaananyi B: Binary ya ransomware ekola butereevu MUNDA mu nkola y'emirimu ya NAS Linux yennyini (DeadBolt, . Qlocker, . eCh0raix):
   • Bwoba tolina Btrfs oba ZFS snapshots enabled (okugeza, ekikadde ext4 volume) era drives zisiiga nnyo nga NAS encrypts copy yo yokka eya files, nyiga era onyige physical front Power Button ku NAS okumala sekondi 5 ku 10 okukaka hard power-off amangu ddala (oba okusika DC/AC power plug singa button eba teddamu). Buli ddakiika NAS lw’esigala ng’ekola ereka CPU yaayo okusiba gigabytes endala 5 ku 20 eza fayiro zo.
   • Okulabula okukulu (Why DeadBolt & Qlocker victims must NOT reboot after recovery): Ebika bya Ransomware nga Qlocker (ekitambuza fayiro mu zikuumibwa n'ekigambo ky'okuyingira .7z archives nga bakozesa 7z) ne DeadBolt oluusi kuuma embeera y'okusiba ekola oba ebisumuluzo by'okuggya ensirifu mu /tmp (RAM) oba okuwamba web UI binary (/home/httpd/index.html). Bw'oba okyalina ekisusunku ky'ekikolo kya SSH eky'omu kitundu ekiggule mu NAS, kebera ps aux era /tmp nga tonnaba kuggyako masannyalaze (laba Omutendera 2 wansi).
6. Yingira mu router yo eya yintaneeti / firewall (192.168.1.1 / . 192.168.0.1 / UniFi / pfSense / ISP gateway) amangu ddala era OFF UPnP (Universal Plug and Play) ERA osazeewo amateeka gonna aga WAN Port Forwarding agasonga ku NAS yo:
7. Ebitundu ebisoba mu 80 ku buli 100 eby'obulwadde bwa NAS ransomware obw'awaka ne mu ofiisi entono bubaawo kubanga omukozesa yanyiga "Auto Router Configuration / EZ-Internet / UPnP" mu kiseera ky'okuteekawo okusooka, ekyalagira mu kasirise router y'awaka okuggulawo TCP ports 5000, . 5001, . 8080, . 8443, . 443, . 22 (SSH), oba 445 (SMB) butereevu ku yintaneeti yonna ey’olukale (Shodan.io / . Censys).
8. Lemesa UPnP enkalakkalira mu nsengeka za WAN/NAT eza router yo era osazeewo buli tteeka ly'okuweereza port-forwarding erisonga ku ndagiriro ya IP eya NAS ey'omu kitundu.
9. TOtandika, toddamu kusengeka, oba okuddukanya "Reset / Reinstall DSM oba QTS" ku hard drives nga tonnaba kwekenneenya oba ransomware yawamba ekitundu kya OS kyokka oba volume ya data:
10. Mu kulumba nga ** .DeadBolt**, malware ewandiika ku lupapula lw'okuyingira ku mukutu gwa NAS (index.html) okulaga ekiwandiiko ky'ekinunulo ekijjuvu ekiziyiza okuyingira ku dashiboodi y'omuddukanya QNAP/Synology, ne bwe kiba nga kyo ekikulu Btrfs / . ZFS ebifaananyi oba fayiro za vidiyo ennene (ezisukka mu megabytes 20) zikyali 100 ku buli 100 nga tezifudde ku drives.
11. Kebera oba NAS yo erina Btrfs (Synology Snapshot Replication), . ZFS (TrueNAS / . QuTS hero), oba LVM Ebifaananyi eby’omutendera gwa Block (QNAP Storage & Snapshots):
12. Kubanga Btrfs era ZFS ebifaananyi ebitonotono bisomebwa byokka ku layeri ya bulooka y'enkola ya fayiro (ne Synology WORM / Immutable Snapshots teziyinza na kusazibwamu muntu alina obuzibu root admin account), otera okuzza emabega ebitundu 100 ku 100 ebya folda zo ezigabanyizibwa ezikubiddwa ensirifu mu sikonda 60 nga temufiiriddwa data ate nga zero ransom esasuddwa.
13. Nga tonnasasula kinunulo kyonna, manya ekika kya ransomware ekituufu ky’okozesa ID Ransomware (id-ransomware.malwarehunterteam.com) ne No More Ransom (nomoreransom.org):
14. Ebika bya NAS ransomware ebikulu ebiwerako (eCh0raix / . QNAPCrypt, nga bukyali Qlocker okuyita mu photorec / . qrescue okuggyamu ebikondo, . Muhstik, era SynoLocker) balina enkola z’okuggya ebisumuluzo ez’olukale ez’obwereere oba enkola z’okuggya ebisumuluzo mu kkooti ezifulumizibwa abakuumaddembe n’abanoonyereza ku by’okwerinda.

Omuti gw’okusalawo: okulonda amangu NAS ransomware n’ekkubo ly’okuzzaawo¶

Kozesa enkola eno okuzuula oba obulumbaganyi bwasibuka ku kompyuta ya LAN oba butereevu ku NAS, era londa enkola esinga obukuumi ey’okuzzaawo:

flowchart TD
    Symptom["NAS Evuga Okusiiga ku 100% + Fayiro Zikyusiddwa Erinnya (.deadbolt, .7z, .ech0raix, .lockbit) oba Web UI Eraga Ransom Screen"] --> PullLAN["OMUDDAALA 1 (Mu Sikonda 5): Ggyako Cables zonna eza Ethernet Okuva Emabega wa NAS"]

    PullLAN --> SourceCheck{"Encryption Yayimiriza Amangu Gw'oggyamu Cable ya NAS Ethernet?"}

    SourceCheck -->|"YEE: Omulimu gwa Disiki Gugudde ku Zero Nga LAN eggyiddwako"| SMBVector["SOURCE A: Ransomware Ekola ku Windows/Mac PC ku Network Yo era Encrypting Shared Folders Ku SMB"]

    SourceCheck -->|"NO: NAS Hard Drives Zigenda Mu maaso N'okukuba Nga Ethernet Eggyiddwako (Oba NAS Web Login Page Yennyini Yakyusibwamu Ransom Screen)"| DirectNAS["ENSONGA B: Ransomware Binary Ekola Butereevu Munda Mu NAS OS (Ekozesebwa okuyita mu UPnP / Exposed WAN Ports 5000, 5001, 8080, 443, 22)"]

    SMBVector --> IsolatePC["Funa & Ggyako PC Efunye Obulwadde ku LAN Yo -> Okuzzaawo NAS Shared Folders Okuva mu Btrfs / ZFS / QNAP Snapshots oba Hyper Backup"]

    DirectNAS -->SSHCheck{"Olina Active Local SSH Session Open (Oba Qlocker Ekola 7z)?"}

    SSHCheck -->|"Yee (Qlocker / Enkola ya 7z ekola)"| GrabPass["Kebera ps aux | grep 7z ku SSH Okukwata Plaintext 7-Zip Password Okuva mu Command Line Args Nga Tonnatta Nkola"]
    SSHCheck -->|"Tewali SSH / Disiki z'okusiiga ez'okusika ezitamanyiddwa"| PowerOff["Kwata NAS Power Button 5-10 Seconds okukaka Hard Power-Off Amangu kale Unencrypted Files & Free Space Zikuumibwa"]

    GrabPass --> KillUPnP["OMUDDAALA 2: Yingira mu Router -> Lemesa UPnP Enkalakkalira + Sazaamu Amateeka Gonna agakwata ku Port Forwarding (5000, 5001, 8080, 443, 22)"]
    PowerOff --> KillUPnP
    IsolatePC --> KillUPnP

    KillUPnP --> RecoveryPath{"Eby’obugagga ki eby’okuzzaawo eby’obugagga ebiriwo ku NAS?"}

    RecoveryPath -->|"Btrfs / ZFS / QNAP Block Ebifaananyi Ebikutte Biriwo"| SnapRestore["Okwoza OS Partition / Firmware Update -> Roll Back Folders ezigabibwa okutuuka ku Pre-Attack Snapshot"]
    RecoveryPath -->|"USB ey’ebweru / Okutereka ekire eky’ebweru w’ekifo (Hyper Backup / HBS 3)"| BackupRestore["Wipe & Rebuild NAS ku Patched Firmware -> Okuzzaawo Okuva ku Offline/Cloud Backup"]
    RecoveryPath -->|"Tewali Snapshots & Tewali Backups"| ForensicCarve["Clone Drives Read-Only -> Kebera NoMoreRansom.org + Run PhotoRec / QRescue Okubumba Okutagabibwa (Naddala Okukola Ku Qlocker)"]

Engeri NAS Ransomware gy'emenyamu: Ebintu Ebibiri Ebilumba¶

Nga tonnaba kuzza NAS yo mu switch yo ey’omukutu gw’omu kitundu, olina okumanya ku vectors ebbiri ez’enjawulo ddala ez’okuyingira eyakkiriza ransomware ku voliyumu zo ez’okutereka:

Omutendera 1: Okuggala Enkola ya Intaneeti (Router UPnP, . Port Forwarding, ne Cloud Relays) .¶

Singa oyoza oba okuzzaawo NAS yo nga toggaddewo kinnya kya network ku router yo, automated botnets ezisika endagiriro yo eya IP ey’olukale zijja kuddamu okusiiga NAS mu ssaawa ntono oluvannyuma lw’okugikomyawo ku mutimbagano. Sooka omalirize network lockdown eno ku router yo:

1. Yingira mu Internet Router / Firewall Admin Console yo:
2. Ggulawo browser ku kompyuta oba essimu ennyonjo era ogende ku gateway IP ya router yo (mu ngeri entuufu 192.168.1.1, . 192.168.0.1, . 10.0.0.1, oba ng’oyita mu app yo eya mesh router nga UniFi, . Eero, . Google Home, . TP-Link Deco, . ASUS Router, . Netgear Nighthawk).
3. Lemaza UPnP (Universal Plug and Play) Enkalakkalira:
4. Genda ku Advanced > NAT Forwarding / WAN / Network > UPnP era okyuse UPnP okudda ku OFF / Disabled.
5. Lwaki UPnP kya bulabe nnyo eri bannannyini NAS: UPnP bw’ekozesebwa ku router yo, ekyuma kyonna ku mutimbagano gwo ogw’omu kitundu (nga mw’otwalidde n’omugezi wa NAS yo eya "EZ-Internet" oba "Auto Router Configuration", oba malware ku smart TV) kisobola okusindika mu kasirise IGD (Internet Gateway Device) okusaba ku router yo ng'ogamba "Ggulawo WAN Port 8080 ne 5001 ey'ebweru ku IP yange eya wano 192.168.1.50", ng'oyita ku firewall yo nga tosabyeko password yo eya router."
6. Sazaamu byonna eby'okuweereza ku mwalo mu ngalo (Virtual Server) & . DMZ Amateeka agasonga ku NAS:
7. Genda ku Advanced > NAT Forwarding > Port Forwarding (oba Virtual Servers) era osazeeko buli tteeka eriweereza emiryango gya TCP oba UDP (80, . 443, . 5000, . 5001, . 8080, . 8443, . 21 FTP, . 22 SSH, 1999. 873 rsync, . 445 SMB, . 32400 Plex bwe kiba tekikyetaagisa) ku NAS IP yo.
8. Kebera Advanced > DMZ era okakasizza nti DMZ Host is Disabled (okuteeka NAS IP mu DMZ ya router kiraga emikutu gyonna egya TCP ne UDP 65,535 egya NAS butereevu ku yintaneeti ey’olukale).
9. Kakasa okuva ebweru wa Network Yo Nti Zero NAS Ports Ziggule:
10. Lambula shodan.io oba grc.com (ShieldsUP) oba dduka port scan okusinziira ku ndagiriro yo eya public WAN IP okukakasa nti ports 5000, . 5001, . 8080, . 8443, . 443, era 22 kati ddayo ** .Filtered / Stealth / Closed**.

Omutendera 2: Okusunsula mu mbeera ez’amangu ezikwata ku kika (Qlocker, . DeadBolt, . eCh0raix) .¶

Nga tonnasiimuula NAS oba okusasula ekinunulo, kebera ekika ki ekigere ekya NAS ransomware ekikubye ekyuma kyo. Buli famire ya NAS enkulu erina obunafu obw’enjawulo obw’ekikugu obusobozesa okuzzaawo data ekitundu oba kyonna awatali kusasula:

1. Singa Fayiro Zo Zakyusibwamu .7z Ebiwandiiko ebikuumiddwa (Qlocker ku QNAP / Linux NAS)¶

Engeri Qlocker ekola: Mu kifo ky’okuwandiika yingini ya custom cryptographic, . Qlocker ekola script eyita NAS yennyini ezimbiddwamu ** .7-Zip (/usr/local/sbin/7z)** binary okunyigiriza buli fayiro mu ekuumibwa n'ekigambo ky'okuyingira .7z archive n'oluvannyuma n'eddukanya Linux eya bulijjo rm (unlink) ku fayiro eyasooka. - Triage Trick #1 (Okukwata Password Live mu ps aux Nga Tonnaggyako Amasannyalaze): Singa Qlocker mu kiseera kino ekyakola ku NAS yo era osobola okuyingira mu kitundu ng’oyita mu SSH (ssh admin@nas-local-ip), dduka ekiragiro kino amangu ddala nga tonnaggyako masannyalaze:

ps aux | grep 7z

2. Singa NAS Login Screen Yo Yakyusibwamu DeadBolt Omuko gw'ekinunulo (.deadbolt fayiro) .¶

Engeri DeadBolt emirimu: 1. DeadBolt akyusizza /home/httpd/index.html (oba /home/httpd/cgi-bin/index.cgi) nga erina omuko gwayo ogwa binary/HTML oguwamba web browser yo buli lw’ogezaako okuggulawo QNAP QTS / Asustor ADM dashboard, nga esaba Bitcoin mu kuwaanyisiganya ekisumuluzo kya master decryption eky’ennukuta 32 (ekiweebwayo ng’oyita mu Bitcoin eri ku lujegere OP_RETURN okutunda ebintu). 2. Engeri y'okuddamu okufuna omuzira wa QNAP QTS / QuTS Admin Dashboard yo nga tofiiriddwa data yo: - Eky'okulonda A (Okuyita mu SSH ey'omu kitundu singa esobozeseddwa): SSH mu NAS mu kitundu (ssh admin@<nas-ip>), mukomye omufere deadbolt enkola bwe kiba nga ekola, era okole script ya QNAP entongole ey'okuzzaawo firmware oba okuzzaawo eyasooka /home/httpd/index.html okuva mu kifaananyi kya ROM eky’enkola esomebwa yokka (/mnt/HDA_root/update_pkg/). - Eky'okulonda B (Diskless Firmware Flash + Okuddamu okuyingiza Hot-Plug): 1. Ggyako amasannyalaze ku NAS. 2. Serengesa hard drive zonna ebweru ne sentimita 2 (yinsi emu) zisobole okukutulwa ku backplane (namba bay order yazo n'obwegendereza ne painter's tape sooka). 3. Amaanyi ku NAS etaliimu hard drives, funa IP yaayo ng'oyita mu Qfinder Pro, bw'obuuziddwa ku setup screen hot-plug drives zidde mu bays zazo entuufu, era londa "Update Firmware Only (Keep All Data and Settings)" (tonyiga "Initialize System", ekisangula drives). 3. Ekikulu mu kukuuma amateeka Decryption Note ku... DeadBolt: Mu bikwekweto ebikwasaganyizibwa nga bikulembeddwamu Dutch National Police (Politie), E Bulaaya (No More Ransom), ne Responders.nu, abakuumaddembe bafunye obuwanguzi mu kulimba... DeadBolt okutiisatiisa abazannyi mu kiseera ky’okulinnya kw’ebisale bya mempool mu kufulumya ebisumuluzo ebisukka mu 150 eby’okuggya ensirifu mu ngeri ey’ekikugu nga tebannasazibwamu n’okutunda kwa Bitcoin ku ssente entono ez’abalumbaganyi nga bayita mu Replace-By-Fee. Kebera deadbolt.responders.nu era nomoreransom.org okulaba oba specific yo DeadBolt ekisumuluzo ky’endagiriro y’omugenzi kyakwatiddwa poliisi.

3. Singa Fayiro Zo ziggwa mu .encrypt (eCh0raix / . QNAPCrypt) .¶

• Emilembe egiwerako egy’... eCh0raix (QNAPCrypt) bakozesa ensibuko y’ekisumuluzo kya AES ekirimu obuzibu oba nga balina ekiragiro-n’okufuga kwabwe (C2) database eyakwatibwa abanoonyereza ku by’okwerinda n’abakuumaddembe.
• Lambula nomoreransom.org era oteeke fayiro bbiri ezikubiddwa ensirifu (oba ekiwandiiko ky’ekinunulo README_FOR_DECRYPT.txt) okugezesa Bitdefender / NoMoreRansom ey'obwereere eCh0raix Decryptor nga tonnasiimuula kintu kyonna.

Omutendera 3: Okuzzaawo Fayiro Zo okuva Btrfs, . ZFS, oba QNAP Ebifaananyi eby'amangu mu Sikonda 60¶

Singa NAS yo yali ensirifu ne Vector #2 (PC erimu ransomware ku LAN yo ng’esiba ebitabo ebigabanyizibwa ku SMB), oba singa walina Immutable (WORM) Ebifaananyi oba LVM/Btrfs/ZFS Snapshots ezitakwatibwako mu kiseera ky’okulumba obutereevu NAS, osobola okuzzaawo ebitundu 100 ku 100 ebya fayiro zo amangu ddala:

1. Ekifo kya Disiki ekya Synology (DSM 7.x nga balina Btrfs Okukoppa Ebifaananyi eby'amangu)¶

1. Okusooka, kakasa nti PC eriko akawuka ku LAN yo ekutuddwa ku mutimbagano, era olongoose Synology DSM okutuuka ku kisembyeyo okufulumizibwa wansi wa Control Panel > Update & Restore.
2. Ggulawo ekipapula kya Snapshot Replication munda mu Synology DSM.
3. Nywa ku Recovery mu bbaala ya kkono.
4. Londa Shared Folder eriko ensirifu (oba iSCSI LUN) n'onyiga ku Recover.
5. Lambula olukalala lw'ebifaananyi ebitegekeddwa (GMT+...) era londa ekifaananyi ekikubiddwa amangu ddala nga okusiba kwa ransomware tekunnatandika (sooka kebera Ekikolwa > Browse okusooka okulaba fayiro eziri munda mu kifaananyi ekyo n’okukakasa nti nnyonjo era tezisibiddwa).
6. Nywa ku Ekikolwa > Ddamu ku kifaananyi kino (oba Clone n'erinnya eppya bw'oba oyagala okukuuma folda ensirifu nga tekwatibwako bujulizi bwa forensic nga amangu ago ossaako kkopi ennyonjo eya folda egabanyizibwa).
7. Kubanga Btrfs ye Kopi-ku-Wandiika (CoW) enkola ya fayiro, okudda emabega ekitabo ekigabanyizibwa ekya terabyte 20 mu kifaananyi ekisooka okulumba kitwala sekonda ezitakka wansi wa 10.

2. QNAP NAS (QTS Ebifaananyi bya LVM eby'omutendera gwa Block & . QuTS hero ZFS Ebifaananyi eby'amangu)¶

1. Oluvannyuma lw'omuzira wa QTS/QuTS okuteekebwako patch n'okwawulwa okuva ku WAN, ggulawo Storage & Snapshots.
2. Genda ku Storage > Storage/Snapshots, londa Thick Volume, Thin Volume, oba ZFS Shared Folder yo ekoseddwa, era onyige Snapshot Manager (akabonero ka camera).
3. Londa ekifaananyi ekiyonjo ekisembayo ekyakwatibwa nga tebannaba kussaako kiseera kya kulumba.
4. Lambula omuti gwa folda munda mu kitundu kya ddyo okukakasa nti fayiro zo tezirina kamogo, olwo onyige Revert Volume Snapshot (oba londa folda zonna n’onyiga Restore okuwandiika ku fayiro zokka ezikuumibwa).

3. TrueNAS (CORE / . SCALE ku ZFS) ne Unraid (ZFS / . Btrfs) .¶

• Ku TrueNAS (ZFS): Genda ku Okutereka > Ebifaananyi (oba Okukuuma Data > Emirimu gy'okukuba ebifaananyi buli luvannyuma lwa kiseera), funa ekifaananyi ekiyonjo (tank/share@auto-2026-10-31_12-00), era onyige Rollback (oba clone ekifaananyi ekikwata ku dataset empya zfs clone tank/share@auto-2026-10-31_12-00 tank/share_recovered kale tofiirwangako bifaananyi bipya eby’omu makkati).

Omutendera 4: Okukakanyaza NAS Yo Esobole Nate Kuddamu Ku Encrypted (Olukalala lw’Ensonga 7)¶

Data yo bw’emala okuzuulibwa, kozesa amateeka gano omusanvu ag’okusengeka agakakatako ku kyuma kyo ekya Synology, QNAP, TrueNAS, oba Asustor nga tonnaddamu kugiyunga ku mutimbagano:

• 1. Toweereza Port Yonna ku Router Yo ku NAS Yo: Kozesa Tailscale oba WireGuard VPN Mu kifo ky'ekyo:
• Teeka Tailscale package entongole okuva mu Synology Package Center / QNAP App Center (oba ddukanya router yo ezimbiddwamu WireGuard VPN Server).
• Tailscale ekola omukutu gw’akatimba ogwa WireGuard ogw’ensirifu ogw’okusengeka ziro, ogw’okugatta ku munne (100.x.y.z) wakati w'essimu yo, laptop yo, ne NAS yo nga zero open ports ku firewall yo eya router y'awaka. Osobola okuyingira mu bifaananyi byo ebya NAS, fayiro, ne admin screen okuva wonna mu nsi ate nga NAS yo esigala 100% nga telabika eri internet scanners nga Shodan.
• 2. Lemaza Ekisookerwako Ekizimbibwamu admin Akawunti n'okukola Custom Named Administrator ne Mandatory 2FA:
• Synology DSM ne QNAP QTS zombi zisindika ne akawunti esookerwako eyitibwa ** .admin** (UID 1024 oba UID 0). Bots za brute-force ezikola mu ngeri ey’obwengula zikuba ennyondo erinnya ly’omukozesa admin 24/7.
• Tonda akawunti y'omuddukanya empya ddala n'erinnya ly'omukozesa ery'enjawulo, yingira n'akawunti eyo empya, genda ku Control Panel > User & Group (oba Abakozesa), era Lemesa ekisookerwako admin akawunti.
• Ggulawo Okukakasa 2-Factor Okukakasibwa (OTP / . Passkey / . Approve Sign-in) ku akawunti zonna ez'omuddukanya.
• 3. Ggyako ON Imutable (WORM) Ebifaananyi eby'amangu (7-to-14-Day Retention Lock):
• Ku Synology DSM 7.2+: Ggulawo Snapshot Replication > Snapshots > Settings > Schedule, sobozesa ebifaananyi ebya buli lunaku, era okebere "Enable immutable snapshots" n'ekiseera ky'obukuumi ekya ennaku 7 okutuuka ku 14. Ne bwe kiba nti hacker abba root password yo oba akozesa kernel vulnerability mu DSM, tewali muntu yenna (net even root) asobola okusazaamu Immutable Snapshot okutuusa nga essaawa ya hardware ey'ennaku 7 eweddeko.
• Ku QNAP QuTS hero / QTS: Tegeka Snapshot Replica Vault oba okusobozesa WORM (Write Once, Read Many) enkola z'okukuuma ku migabo emikulu egy'okutereka, era kakasa nti "Reserve Snapshot Space" ekoleddwa.
• 4. Okukugira Olukusa lw'Okugabana Omukutu gwa SMB (Least Privilege) Kale Laptop Infection Tesobola Encrypt NAS Yenna:
• Tokola maapu ya mukama wa NAS yo admin ebiwandiiko ebikakasa munda mu Windows File Explorer (\\NAS\) ku laptop eza bulijjo.
• Tonda akawunti y'omukozesa atali muddukanya eya bulijjo okusobola okuyingira mu fayiro buli lunaku, era oteekewo ebitabo byo eby'okutereka/ebifaananyi (okugeza, 2010-2025 Family Photos Archive) okutuuka ku Soma-Okusoma Kwokka (ro) eri abakozesa desktop buli lunaku olwo singa Windows PC y'omuntu ow'omu maka ekwata ransomware, PC esobola okusoma folda ezo naye tesobola kuzisiba oba kuzikyusa.
• 5. Ggyako NAS Built-In Firewall (Allow LAN + Tailscale Subnets Only) & Okuziyiza mu ngeri ey'okwekolako:
• Munda mu Synology Control Panel > Security > Firewall (oba QNAP QuFirewall), tonda etteeka erikakali ery'olukalala lw'okukkiriza olukkiriza okuyungibwa okuva ku LAN subnet yo ey'omu kitundu yokka (192.168.1.0/24) ne subnet yo eya Tailscale/VPN (100.64.0.0/10), nga kugobererwa etteeka erya wansi eryateekebwa ku Deny All. Omuntu ne bw’akyuka mu butanwa UPnP back on ku router, NAS's own internal packet filter ejja kusuula buli packet ya internet ey'olukale mu kaseera ako.
• 6. Lemesa SSH (Port 22) ne Telnet (Port 23) Nga Tolina Actively Okugonjoola Ebizibu:
• Leka SSH nga efuuliddwa OFF munda mu Control Panel > Terminal & SNMP mu kiseera ky'okukola okwa bulijjo okwa buli lunaku; toggle it on for the 10 minutes you need to run a command line task, olwo ogikyuse ku ddyo oddemu okugiggyako.
• 7. Kuuma Ekire Ekituufu "3-2-1" Eky'Empewo-Ekitundu / Ekitakyuka (Hyper Backup / . HBS 3):
• Goberera ebyaffe... okutereka kompyuta n’ekitabo 3-2-1 eky’okuzzaawo akatyabaga: okutegeka Synology Hyper Backup oba QNAP Hybrid Backup Sync (HBS 3) okusika ekiro ensirifu, ku ludda lwa kasitoma deduplicated backups ku external USB hard drive gy'oggyamu mu mubiri oba ku Object-Locked (S3 Object Lock Compliance Mode) ekibbo ky'ekire ( .Backblaze B2, . Wasabi, oba AWS S3) nga bakozesa ebisumuluzo bya API ebikugirwa eby'okugattako byokka.

Ennamba z’embeera ez’amangu mu bitundu n’ebiragiro by’ebitongole¶

Obulumbaganyi bwa Ransomware obugendereddwamu ebyuma bya NAS bunoonyezebwa ebitongole by’eggwanga ebikola ku bumenyi bw’amateeka ku mikutu gya yintaneeti mu nsi yonna, ebikuuma amaterekero g’ebisumuluzo by’okuggya ensirifu ebyakwatibwa (No More Ransom) n’okulondoola ebikozesebwa mu bumenyi bw’amateeka:

• Amerika ne Canada:
• Okuvaako kw'obulamu-obukuumi mu bwangu: Kuba 911 singa ransomware etaataaganya enkola z’ebyobulamu oba ez’obukuumi bw’omubiri.
• Ekifo eky'okwemulugunya ku bumenyi bw'amateeka ku yintaneeti ekya CISA & FBI (IC3): Loopa kampeyini za NAS ransomware (DeadBolt, . Akira, . LockBit, . Qlocker) ku stopransomware.gov, ** .ic3.gov**, oba kuba ku CISA ku 1-844-Say-CISA (1-844-729-2472).
• Ekitongole kya Canada ekikola ku by'okwerinda ku mikutu gya yintaneeti & RCMP: Alipoota ku cyber.gc.ca (1-833-CYBER-88) oba Ekitongole kya Canada ekilwanyisa obufere.
• Obwakabaka bwa Buganda:
• Empeereza ey'amangu: Kuba 999 (oba 101 ku poliisi etali ya mangu).
• Action Fraud & NCSC: Loopa ebibaddewo ku ransomware ku actionfraud.police.uk oba kuba ku 0300 123 2040 (24/7 layini y'ebibaddewo ku mikutu gya yintaneeti obutereevu). Bizinensi entonotono n’abazirakisa basobola okwebuuza ku NCSC Cyber Incident Response (ncsc.gov.uk) omukutu.
• Omukago gwa Bulaaya:
• Empeereza ey'amangu: Kuba 112 mu mawanga gonna agali mu mukago gwa EU.
• Ekitongole kya Bulaaya ekivunaanyizibwa ku bumenyi bw’amateeka ku mikutu gya yintaneeti ekya Europol (EC3) & . NoMoreRansom.org: Kebera nomoreransom.org (ekuumibwa Poliisi y’eggwanga eya Budaaki, Europol, n’ebitongole ebikolagana nabyo) olw’ebisumuluzo by’okuggya ensirifu bya NAS ransomware ebyakwatibwa, era oloope eri ekitongole kyo eky’eggwanga ekya CSIRT n’ekitongole ekikuuma amawulire (DPA mu ssaawa 72 singa ebikwata ku muntu byaggyibwamu oba bibula wansi wa GDPR).
• Australia ne New Zealand:
• Empeereza ey'amangu: Kuba 000 mu Australia oba 111 mu kibuga New Zealand.
• Ekifo ky'ebyokwerinda ku mikutu gya yintaneeti mu Australia (ACSC): Kuba essimu ya Ransomware eya 24/7 ku 1300 CYBER1 (1300 292 371) oba lipoota ku cyber.gov.au.
• CERT NZ: Alipoota ku cert.govt.nz.
• Buyindi ne Asia-Pacific:
• Buyindi (CERT-In & Ennamba y'obuyambi ku bumenyi bw'amateeka ku mikutu gya yintaneeti): Kuba 1930 oba lipoota ku cybercrime.gov.in ne incident@cert-in.org.in.
• Taiwan (TWCERT/CC, obuyinza bw’awaka obwa Synology, QNAP, ne Asustor PSIRTs): Waayo tikiti z’ebyokwerinda by’abatunzi butereevu ku QNAP PSIRT (service.qnap.com) oba Synology PSIRT (synology.com/en-global/security/advisory).

Ebibuuzo ebitera okubuuzibwa¶

Ransomware yasiiga etya QNAP oba Synology NAS yange nga sinyigako ku link yonna ya phishing era nga kompyuta zange nnyonjo ddala?¶

NAS yo yakwatibwa butereevu okuva ku yintaneeti ey’olukale nga tekwata ku kompyuta zo. Oba internet router yo yalina UPnP (`Universal Plug and Play`) . enabled (okukkiriza ekintu kya NAS ekya "Auto Router Configuration / EZ-Internet / myQNAPcloud" okuggulawo emiryango mu kasirise 8080, . 443. Ebiragiro, . 5000, . 5001, oba 22. ku firewall yo), oba waweereza mu ngalo omwalo okuyingira mu fayiro zo okuva ewala. Botnets ezikola mu ngeri ey’obwengula zisika buli kiseera buli ndagiriro ya IP ey’olukale ku yintaneeti ne zikozesa obuzibu obutalongooseddwa oba obunafu admin ebigambo ebikusike ku nkolagana z’omukutu za NAS ezibikkuddwa.

Nsobola ntya okumanya oba ransomware yaddukira butereevu munda mu NAS OS yange vs. ku emu ku kompyuta zange eza Windows ku network share?¶

Laba ebiraga bisatu: Ekisooka, singa... NAS web administration okuyingira screen yennyini yakyusibwamu n’akawandiiko k’ekinunulo (nga DeadBolt nga bano), oba singa NAS yokka erina fayiro ezisibiddwa nga buli PC ku mutimbagano gwo nnyonjo, malware ekola butereevu munda mu NAS Linux OS. Ekyokubiri, ggulawo... NAS Connection Log / SMB Ekiwandiiko ky'okutambuza fayiro (mu Synology Ekifo ky’Ebiwandiiko oba QNAP Ekifo kya QuLog): singa olaba endagiriro ya IP ya LAN ey’omu kitundu (nga 192.168.1.24) okukola enkumi n’enkumi z’amangu Wandiika / Kyuusa erinnya / Ssaawo emirimu giwedde SMB, olwo kompyuta ku 192.168.1.24 ye kyuma ekirimu akawuka ekisiba NAS yo ku mutimbagano.

Lwaki yakola DeadBolt okusiba entandikwa yokka eya fayiro zange ennene eza vidiyo oba database, era nkyayinza okuzannya oba okuddaabiriza fayiro ezisibiddwa ekitundu?¶

Okusiba amakumi ga terabytes za NAS storage nga nnannyini yo tannalaba hard drives nga zisenya n’okusika plug, strains like DeadBolt nga bano encrypt yokka ku ebisooka 512 kilobytes (`524,288 bytes`) . wa buli fayiro n’ogattako .ekizibu ky’okufa okugaziya, okuleka gigabytes ezisigaddewo eza fayiro nga tezikwatibwako mu biwandiiko ebya bulijjo. Nga okufiirwa KB 512 ezisooka kisaanyaawo ddala ebiwandiiko ebitonotono n’ebifaananyi bya JPEG, fayiro za vidiyo ennene ezirina gigabyte eziwera (`.mp4`, . `.mov`, . `.mkv`), ebifaananyi bya kkamera ebibisi, n’ebifaananyi ebimu ebya disiki y’ekyuma ekirabika (`VMDK`/ .`VHDX`) oba database za SQL zitera okuddaabirizibwa nga osimbuliza omutwe gw'ekintu ekituufu (`moov` atom) okuva mu vidiyo endala eyakwatibwa ne kamera y’emu nga tukozesa ebikozesebwa nga untrunc.

Ye Synology ye QuickConnect oba myQNAPcloud Link safe okuleka enabled singa nzigyako router UPnP ne Port Forwarding?¶

Nga router UPnP ne manual port forwarding zizikiddwa ddala, outbound relay services nga Synology Relay ya QuickConnect era myQNAPcloud Omukutu gwa yintaneeti zirina obukuumi bungi okusinga emikutu gya WAN egyaggule kubanga teziggulawo miryango gya kuwuliriza ku firewall ya router yo. Wabula bakyabikkula screen yo ey’okuyingira mu NAS (`DSM` / . `QTS` web authentication handler) eri omuntu yenna amanyi oba ateebereza wo `QuickConnect ID`. Okusobola obukuumi obusingako, lemesa public relay access ku admin interface era okozese Omukira gw’omukira oba VPN ya WireGuard mu kifo ky’ekyo, ekyetaagisa okukakasa ekyuma kya cryptographic nga tannabaawo packet emu eya HTTP esobola n'okutuuka ku web server yo eya NAS.

Nsasula ekinunulo kya Bitcoin ku DeadBolt, . Qlocker, oba eCh0raix bwemba sirina backups ate nga sirina snapshots?¶

Ebitongole ebikuumaddembe (`FBI`, . `CISA`, . `Europol`, . `NCSC`) bawa amagezi nnyo obutasasula kinunulo kubanga okusasula ssente z’ebibiina by’abamenyi b’amateeka era tekulina bukakafu nti script y’omulumbaganyi ey’okuggya ensirifu mu ngeri ey’obwengula ejja kukola awatali kwonoona fayiro. Nga tonnalowooza ku kusasula: (1) Ekifaananyi oba okukuuma drives oleme kwongera kubikola, (2) Kebera **`nomoreransom.org`** ne ** .`deadbolt.responders.nu`** okulaba oba abakuumaddembe baakwata dda ekisumuluzo ekikulu eky’ekika kyo, (3) Ku **`Qlocker`**, dduka ** .`PhotoRec` / . `QRescue`** ku kifo kya disiki ekitagabibwa (ekitera okuzzaawo ebitundu 60% ku 90% ku bisookerwako ebyasangulwa ku bwereere), ne (4) Ku binene `.mp4`/ .`.mov` obutambi obukubiddwa okusiba ekitundu-omutwe, okugezesa okuddamu okuzimba omutwe ne `untrunc`.

Ebiragiro ebikwatagana nabyo¶

• Okukwatibwa malware, ransomware, ne spyware: okuziyiza amangu n’okuddamu okukola
• Okukuuma routers z’awaka n’ebyuma bya IoT
• NAS RAID array ekendedde, drive eziwera, n'okuzzaawo ZFS/Btrfs
• Okutereka kompyuta, enkola ya 3-2-1, n’okuddamu okukola mu mbeera y’akatyabaga
• Zero-day exploit patching ez’amangu n’okwawula ebyuma ku nkomerero y’obulamu
• Ennamba z’amangu okusinziira ku nsi

Ensonda n’obulagirizi obutongole¶

• Ekitongole ky’ebyokwerinda ku mikutu gya yintaneeti n’ebizimbe (CISA) & Ekitongole kya Federo ekikola ku kunoonyereza (FBI) ( ) ( ) .StopRansomware.gov): Alert ku Network-Attached Okutereka (NAS) Ebyuma Ebigendereddwamu DeadBolt, Qlocker, eCh0raix, ne Akira Ransomware.
• Europol Ekitongole kya Bulaaya ekivunaanyizibwa ku bumenyi bw’amateeka ku mikutu gya yintaneeti (EC3) & Poliisi y'eggwanga lya Budaaki (Politie) ( ) ( ) .NoMoreRansom.org): Okukwata Ebisumuluzo bya DeadBolt, ECh0raix Decryptor Repository, n'Endagiriro y'okukendeeza ku Ransomware.
• Ttiimu ekola ku bibaddewo mu by’okwerinda by’ebintu bya QNAP (QNAP PSIRT) & Synology Security Advisory Board: Eby'ekikugu ku kulemesa Router UPnP, Okuzzaawo Admin Consoles ezawambibwa, QRescue (PhotoRec) Okuzzaawo Okutagabanyizibwa, n'Okusobozesa Ekitakyuka WORM Ebifaananyi eby'amangu.
• Ekitongole ky’eggwanga eky’ebyokwerinda ku mikutu gya yintaneeti (NCSC) (United Kingdom): Okukendeeza ku Malware ne Ransomware ku Network Storage n'ebyuma bya ofiisi entono.