NAS Ransomware Playbook: Recover QNAP and Synology

When files on a network attached storage device are suddenly renamed and a ransom note appears in every share, the next hour decides whether snapshots and backups survive or are overwritten. NAS appliances hold file shares, backups of other systems and sometimes the only copy of a small organisation's data, so a NAS encryption event is often a business continuity incident as well as a security one. This playbook covers how the incident shows up, the triage questions to answer first, isolation and containment in priority order, snapshot and backup checks, firmware and account clean-up, ransom note handling and the realistic data recovery options. It is written for IT administrators, managed service providers and incident responders, and uses QNAP and Synology devices as worked examples because they are widely deployed; the method applies to other NAS platforms. Platforms are listed alphabetically, and the order is not a ranking.

This is an independent guide from NHI Mgmt Group, based on QNAP's public documentation and Synology's public documentation as of November 2026. It is not sponsored or reviewed by QNAP or Synology. Product features change, so confirm settings against each vendor's current documentation.

Key takeaways

Disconnect first, then think. Both vendors' ransomware guidance starts with disconnecting the affected computer or device from the network to stop further encryption.
Snapshots are the fastest recovery path. A snapshot taken before the encryption can restore shares in minutes, provided it was not deleted and you restore without reconnecting infected clients.
Find the writer before you restore. Files on a NAS can be encrypted by malware on the device itself or by an infected PC writing through a mapped share; the containment differs.
Treat the device as untrusted until rebuilt or verified. Update firmware from the vendor, reset all accounts, and remove any internet exposure before data goes back on it.
Do not pay as a first step. No More Ransom, the Europol supported project, advises against paying and offers free decryptors for some families.

How the incident shows up

Signal	Where you see it	What it suggests
Files in shares renamed with a new extension; text or HTML ransom notes in folders	Users, file explorer, NAS file manager	Encryption under way or complete (ATT&CK T1486)
The NAS web login page replaced by a ransom message	Admin web interface	Malware running on the device itself
Snapshots or backup tasks missing or failed	Snapshot manager, backup app logs	Recovery sabotage (T1490 Inhibit System Recovery)
Sustained high CPU and disk activity outside business hours	Resource monitor, vendor notifications	Mass file rewrite
Failed and then successful admin logins from unknown IPs	System and connection logs, security tools	Brute force or stolen credentials over an exposed service (T1133 External Remote Services, T1110)
New admin accounts, enabled SSH or Telnet, unknown apps installed	User and service settings, app centre	Attacker persistence on the device
Only some shares affected, matching one user's mapped drives	File timestamps, access logs	An infected client encrypted the shares it could write

Initial access to NAS devices is commonly through services exposed to the internet: the admin web interface, file services or remote access features published by port forwarding or UPnP, exploited before updates were applied (T1190 Exploit Public-Facing Application), or reached with reused passwords. The other common path is a compromised Windows PC with write access to shares.

Triage questions

Is the device itself compromised or only its data? A ransom page on the admin login, unknown processes or apps, or changed system settings point to the device. Encrypted files only in shares one user can write point to a client.
Is encryption still running? Check whether file names are still changing and CPU or disk activity remains high.
Which shares, volumes and replicas are affected? Include backup targets on the NAS and any replication partner that may have synchronised encrypted files.
Do clean snapshots still exist? Note the newest snapshot that predates the first encrypted file, and whether snapshots were protected against deletion.
Do off-device backups exist? Identify the last backup to another device, cloud or removable media, and whether it is reachable from the compromised NAS credentials.
How was the device reachable? List router port forwards, UPnP mappings, DMZ settings, vendor relay or remote access services, VPN and which services were enabled.
Was data copied out first? Check router or firewall logs for large outbound transfers. Theft changes the notification decision even when files are restored.

Containment priorities

Disconnect the network. Unplug the NAS network cable or block it at the switch, and disconnect any PC that may be the encryption source. QNAP's guidance is to disconnect the infected computer from the internet, remove its connection to the NAS and, if possible, disconnect the NAS cable too. Synology's guidance also starts with disconnecting the affected computer from the internet to stop the spread.
Keep the device powered on where you can. A running device keeps logs and process state, and a reboot can trigger update or clean-up routines that change evidence. Power off only if encryption continues after disconnection and you cannot stop it any other way.
Remove internet exposure. On the router, delete port forwards to the NAS, disable UPnP and any DMZ host entry. Use a VPN for remote administration instead of exposing NAS services directly.
Protect what remains. Pause replication and sync tasks so encrypted files are not pushed over good copies on a second device or in cloud storage. Disconnect USB backup drives.
Stop client mounts. Ensure no PC remounts infected shares until it has been checked.
Change credentials from a clean device. Reset all NAS administrator passwords and any credentials stored on the NAS for cloud or remote backup targets. See the Backup Identity Isolation Guide.

Eradication

Update firmware from the vendor. Install the current QTS, QuTS hero or QES release on QNAP, or the current DSM release on Synology, downloaded from the vendor's own site. Read each vendor's security advisories page for the model and apply every relevant fix.
Remove unknown accounts, apps and tasks. Delete accounts you did not create, uninstall apps you do not recognise, and review scheduled tasks and startup settings in the admin interface.
Run the vendor's security tools. On QNAP, update and run Malware Remover and review Security Center and QuFirewall, which QNAP says should be kept current. On Synology, run Security Advisor, which Synology describes as scanning for malware, vulnerabilities and abnormal login activity.
Disable services you do not use. Turn off SSH, Telnet and any file or media services not in use, and move remaining services off default ports where the vendor recommends it. Deactivate any default administrator account once a named admin account exists.
Consider a full reset. If the device itself ran malware, the safest path is to copy off any data you still need, reset the device to factory state, reinstall current firmware and rebuild configuration by hand. Vendor support can confirm the right reset procedure for the model.
Clean the clients. Any PC that may have encrypted the shares must be investigated and reimaged before it reconnects. See the Ransomware Response and Recovery Guide for the wider estate.

Recovery

Choose the recovery route by what survived. Work through the options in this order.

Recovery option	When it applies	Speed	Watch for
Restore from on-device snapshot	Snapshots predating the encryption exist and the device is trusted or reset	Fastest	Restore only after clients are clean; check the snapshot date against the first encrypted file
Restore from a replica on a second NAS	Snapshot replication or backup to another device ran before the attack	Fast	Make sure replication did not copy encrypted files over the replica
Restore from off-site or cloud backup	Backup jobs ran to cloud, remote server or rotated drives	Slower, bandwidth bound	Credentials for the target were stored on the NAS; rotate them first
Free decryptor	No More Ransom or law enforcement lists a decryptor for the identified family	Varies	Test on copies of encrypted files only; see the Ransomware Decryptors guide
Professional data recovery	No clean copy exists	Slow, costly, not guaranteed	Keep encrypted disks unchanged for this

QNAP

QNAP documents restoring from snapshots in Storage Manager, then Snapshot Manager: select a snapshot taken before the attack, remove the encrypted files from the affected folder and restore them from the snapshot. Where snapshots are not available, QNAP points to restoring remote copies made with Hybrid Backup Sync. For future resilience, QNAP recommends block-based snapshots with Snapshot Reserve Space so a minimum number is always kept, Snapshot Replica to a second QNAP device, and backup tools that run with limited user accounts rather than the administrator.

Synology

Synology documents recovery by restoring backups from a local or off-site Synology system, and recommends immutable snapshots, which prevent unauthorised changes to data and snapshots, replicated to a Synology server at a secondary location. Snapshots are managed on DSM, where a pre-attack snapshot can be restored to the shared folder once clients are clean. For wider protection, Synology lists Security Advisor for regular scans, Active Backup for Business for centralised backups with bare-metal and file-level recovery, Secure SignIn for stronger login, and Central Management System for keeping several devices updated together. Synology also notes that paying a ransom does not guarantee a working decryption key.

After restoring

Restore to a device that is updated, reset or verified, with internet exposure removed.
Reconnect clients one at a time after they are checked, watching for renewed file renames.
Re-enable replication and backup jobs only after the restored data is confirmed clean.
Turn on deletion protection for snapshots where the platform offers it, and keep at least one copy offline or immutable.

Evidence to preserve

Evidence	Why it matters	How to keep it
Ransom note and sample encrypted files	Family identification and decryptor checks	Copy to clean storage; do not open on a production PC
NAS system, connection and access logs	Entry point, logins, accounts used	Export from the admin interface before reset or update
Router and firewall configuration and logs	Port forwards, UPnP mappings, outbound transfers	Screenshot or export configuration; save logs
List of accounts, apps, services and scheduled tasks	Persistence the attacker added	Screenshots with timestamps before removing anything
Snapshot and backup job history	Proof of what was deleted and when	Export or screenshot job logs
Client PC images	Whether a client was the encryption source	Disk image of suspect PCs before reimaging
Original disks where no clean copy exists	Future decryptor or professional recovery	Remove and store safely, labelled by bay

Playbook phase	NIST CSF 2.0	NIST SP 800-53 Rev 5	MITRE ATT&CK v20 addressed
Triage	RS.AN-03	IR-4	T1190, T1133 External Remote Services
Containment	RS.MI-01	SC-7, AC-2	T1486 Data Encrypted for Impact
Eradication	RS.MI-02	IR-4, IA-5	T1136 Create Account
Recovery	RC.RP-01, RC.RP-03	CP-9, CP-10	T1490 Inhibit System Recovery
Preparedness	PR.DS-11	CP-9	Not applicable
Notification	RS.CO-02	IR-6	Not applicable

Notification triggers

Personal data: loss of availability of personal data through encryption is a personal data breach under GDPR and UK GDPR. Article 33 requires notifying the supervisory authority without undue delay and, where feasible, within 72 hours, unless the breach is unlikely to result in a risk to individuals; Article 34 adds notice to individuals when the risk is high. A fast snapshot restore with no theft may reduce the risk assessment, but document the reasoning. See the Data Breach Notification Checklist.
Managed service providers: if you manage the NAS for a client, tell the client promptly; under GDPR Article 33(2) a processor notifies the controller without undue delay.
Regulated sectors: NIS2, DORA and health rules carry their own clocks; check the Cyber Incident Reporting Requirements Map.
Law enforcement: report to the national cybercrime reporting route (in the UK, Report Fraud (which replaced Action Fraud on 4 December 2025); in the US, IC3 or CISA). In Scotland, report to Police Scotland on 101. Reporting can give access to decryptor information.

Practitioner checklist

Remove every port forward, UPnP mapping and DMZ entry that exposes a NAS; use a VPN for remote access.
Schedule snapshots on every share, keep a minimum retained set, and protect snapshots from deletion where the platform supports it.
Replicate or back up to a second device or cloud with credentials that the NAS administrators do not share.
Keep one copy offline or immutable, and test a restore every quarter.
Deactivate default admin accounts, require strong passwords and two-step sign-in for administrators.
Apply firmware and app updates promptly and follow each vendor's security advisories page.
Give users write access only to the shares they need, so one infected PC cannot encrypt everything.
Keep a printed copy of this playbook and the router and NAS admin details offline.

NAS Ransomware Playbook: Isolate, Assess and Recover QNAP and Synology Devices