QNAP hardening and exploited-vulnerability guide: Keeping NAS Devices Off the Ransomware List

QNAP network-attached storage holds the files, backups and media that ransomware crews want, and campaigns such as DeadBolt have repeatedly encrypted internet-exposed QNAP devices directly through vulnerable apps rather than through the network behind them. CISA's Known Exploited Vulnerabilities catalogue (version 2026.10.21) lists 12 QNAP entries across QTS, Photo Station, File Station, Hybrid Backup Sync (HBS 3), Helpdesk and VioStor NVR, and nine are flagged for known ransomware use. This guide covers QNAP-specific hardening: removing internet exposure, administrator and user identities, the credentials a NAS holds for backups and cloud sync, logging, snapshots and the exploited vulnerabilities. It is for IT and security teams in small and mid-sized organisations, and for anyone running QNAP storage in a branch or lab. Backup design in general is in the Backup Security and Immutable Backup Guide, which this page does not repeat. Settings and advisories were checked against QNAP's NAS Security Guide, QNAP security advisories and QTS documentation on 28 October 2026.

Key takeaways

• Exposure is the root cause. QNAP's own guidance is never to connect the NAS directly to the internet and to disable UPnP, DMZ and port forwarding on the router. DeadBolt targeted NAS devices running Photo Station with internet exposure.
• Remote access through a tunnel, not a port. Use a VPN (QVPN, the router's VPN or a site-to-site product) or myQNAPcloud Link instead of publishing QTS services.
• Replace the default admin. Create a named administrator, disable "admin" (disabled by default from QTS 5.0.1 and QuTS hero h5.0.1) and require 2-Step Verification or passwordless login.
• Apps are the attack surface. Most KEV entries are in apps (Photo Station, File Station, HBS 3, Helpdesk). Remove apps you do not use and keep the rest on automatic updates.
• Snapshots are not backups. An attacker with admin rights can delete snapshots. Keep an offline or isolated copy using separate credentials.

How identity and access work in QNAP QTS

QTS and QuTS hero manage local users and groups, can join Active Directory or LDAP, and expose access through several services, each of which authenticates differently.

Admin roles and privileged access

• Disable the default administrator: create a new named administrator account and disable "admin". On older firmware where it is still enabled, do this before anything else; it is the first username attackers try.
• Enforce 2-Step Verification: QTS documentation covers enforcing 2-step verification; QNAP's security guide recommends passwordless login or 2-Step Verification for accounts. Start with every administrator.
• Access protection: enable IP Access Protection and Account Access Protection (in QTS security settings) so repeated failed logins block the source or lock the account. Configure the Allow/Deny List to permit administration only from management subnets.
• Password policy: configure the password policy for length and complexity; QNAP also advises strong passwords for every user account.
• Separate admin and user accounts: administrators should use a normal account for file access and their admin account only for management, so a phished or malware-infected workstation does not hold NAS admin rights.
• Directory integration: joining AD lets you manage users centrally, but restrict NAS administration to a dedicated group and remember that domain-joined admin accounts make the NAS part of your domain attack surface.

See the Privileged Access Management Guide for the wider approach to admin accounts.

Integrations, API tokens and service accounts

A NAS is often an automated backup and sync hub, which makes it a holder of non-human credentials. If the NAS is compromised, these are exposed; if they are over-privileged, a ransomware actor can also destroy your other copies.

See the Backup Identity Isolation Guide for why backup credentials must not be able to delete the backups they write.

Logging and detection

• Security Center scans: choose a security policy level and schedule scans at least monthly; fix findings with the Suggested Settings Assistant.
• Notifications: create Notification Center rules for Warning and Error events and for Security Center risk findings, delivered to a monitored mailbox or system.
• Unusual File Activity Monitoring: enable it to flag abnormal file changes, the earliest signal of encryption in progress.
• Central logging: forward system and connection logs to a syslog collector or SIEM, so logs survive if the NAS is wiped or encrypted.
• What to alert on: admin logins from new sources, new administrator accounts, newly installed apps, changes to Published Services or router configuration, mass file renames, snapshot deletion and disabled sync or backup jobs.
• Malware Remover: schedule a daily scan and keep automatic updates on.

Metrics:

• QNAP devices reachable from the internet on any service (target zero; check with Security Center or an external scan).
• Devices with automatic firmware and app updates enabled.
• Administrator accounts with 2-Step Verification (target 100 percent).
• Days since last successful offsite or offline backup, per device.
• Installed apps not used in the last 90 days.

Known exploited QNAP vulnerabilities

From the CISA KEV catalogue (local copy, version 2026.10.21).

• DeadBolt and Photo Station (QSA-22-24): QNAP detected the campaign on 3 September 2022, targeting NAS devices running Photo Station with internet exposure. Fixed Photo Station versions range from 5.2.14 (QTS 4.2.6) to 6.1.2 (QTS 5.0.1). QNAP's mitigations were to turn off router port forwarding, disable UPnP port forwarding in myQNAPcloud Auto Router Configuration, deselect all Published Services, and use myQNAPcloud Link with Access Control.
• HBS 3 (QSA-21-13): CVE-2021-28799 let remote attackers log in to a device through the backup app. A backup tool becoming the entry point is a reminder to patch backup software as urgently as the operating system.

Legacy and end-of-life models should, in QNAP's words, only be used on an internal network or for offline backups. See the CISA KEV Catalogue Guide for prioritisation.

Choosing a remote access method

Closing exposure only sticks if users have a workable alternative. QNAP lists four options; the right one depends on how often people need remote access and how much data they move.

Small organisations usually do best with a router or firewall VPN plus myQNAPcloud Link for occasional use. Larger estates should put NAS devices behind the corporate VPN or zero trust access service and manage them like any other server.

Hardening baseline

1. Find exposure: check every QNAP device with Security Center and an external scan; review the router for UPnP, DMZ and port forwarding rules pointing at the NAS.
2. Close it: remove port forwards, disable UPnP on the router and in myQNAPcloud Auto Router Configuration, and deselect all myQNAPcloud Published Services.
3. Provide safe remote access: VPN (QVPN, router VPN or SD-WAN) for frequent users; myQNAPcloud Link with Access Control set to Private or Customized for occasional access.
4. Update: update QTS through Control Panel > System > Firmware Update and enable automatic firmware updates; in App Center, install all app updates and enable automatic app updates.
5. Remove unused apps: uninstall Photo Station, Helpdesk, multimedia and other apps you do not use.
6. Admin accounts: named admin, default admin disabled, 2-Step Verification enforced, Allow/Deny List for management subnets, IP and Account Access Protection on.
7. Services: disable Telnet and SSH unless needed; replace the default server certificate; keep file services internal.
8. QuFirewall: enable Basic Protection for your region, and consider the PSIRT and TOR rules if any service must be exposed.
9. Snapshots and backups: schedule snapshots with Smart Versioning and enough free pool space; keep a 3-2-1 copy with at least one offsite or offline copy that NAS admin credentials cannot delete.
10. Monitoring: Security Center schedule, Notification Center rules, Unusual File Activity Monitoring, daily Malware Remover and syslog forwarding.

Before closing exposure, confirm who depends on it and give them the VPN or myQNAPcloud Link path first, so the change does not trigger a workaround. Record router changes so they can be reverted if a business process breaks.

Responding to a ransomware hit

QNAP's security guide sets out these steps, which fit most NAS incidents:

1. Check the logs to determine whether encryption came from another computer over a share or from the NAS itself; the answer decides where else to look.
2. Cut off access by changing router settings so the NAS is no longer exposed, preventing secondary attacks.
3. Pause sync tasks and set snapshots to be retained permanently so clean versions are not rotated away.
4. Update firmware and apps and run Malware Remover before restoring files.
5. If there is no backup, preserve the ransom note and payment instructions before attempting recovery, and contact QNAP support.
6. Rotate every credential the NAS held, starting with cloud backup keys and replication accounts.

See the Ransomware Response and Recovery Guide for the organisation-wide process.

Common misconfigurations

• UPnP left on: myQNAPcloud or apps open router ports automatically, exposing services nobody intended to publish.
• Photo or file sharing apps published for convenience: the exact pattern DeadBolt exploited.
• Snapshots treated as the backup: they sit on the same drives and an attacker with admin rights can delete them.
• Backup destinations reachable with full rights: HBS 3 keys or replication accounts that can delete remote copies let one compromise destroy every copy.
• Auto update off "to avoid surprises": leaves app flaws open long after fixes are released.
• End-of-life models still exposed: no further fixes; restrict to internal or offline use.

Framework mapping

Practitioner checklist

• No QNAP device reachable from the internet; UPnP, DMZ and port forwards removed.
• Remote access via VPN or myQNAPcloud Link with Access Control.
• Default admin disabled; named admins with 2-Step Verification.
• IP and Account Access Protection and an Allow/Deny List for management.
• Firmware and app automatic updates enabled; unused apps removed.
• Telnet and SSH off unless needed.
• Backup and replication credentials scoped so they cannot delete remote copies.
• Snapshots scheduled plus an offline or offsite copy.
• Security Center, Notification Center, Unusual File Activity Monitoring and syslog forwarding in place.
• End-of-life models restricted to internal or offline use.

Standards and references

• QNAP: NAS Security Guide
• QNAP: Security Advisory QSA-22-24, DeadBolt ransomware and Photo Station
• QNAP: Security Advisory QSA-21-13, HBS 3
• QNAP: QTS 5.0.x User Guide, Securing the NAS
• CISA: Known Exploited Vulnerabilities Catalog
• NIST: SP 800-53 Rev. 5
• NIST: Cybersecurity Framework 2.0
• MITRE ATT&CK: Data Encrypted for Impact

Related NHI Mgmt Group resources: Backup Security and Immutable Backup Guide · Backup Identity Isolation Guide · Edge Device Security Guide · SOHO and SMB Router Hardening Guide