Synology NAS hacked, ransomware attack - what can I do?

Thirith

It seems that at some point during the last week my Synology NAS was hacked and everything on it was infected by the 0xxx ransomware virus.

Has this happened to anyone else here? What can I do to make sure that no more damage is done right now? And is there any way I can remove the virus from all the files, or are they pretty much lost?

Some additional information:

• I thought that I always installed Synology updates when they came up... but perhaps I was wrong in this respect. :-/
• I've deactivated Quick Connect on the NAS and I've made sure that there's no active port forwarding on the router linked to the NAS' network address.
• For now the NAS is switched off.

Zilla360

All of the files on your NAS will be RSA 2048 encrypted, at a bare minimum, and if their key is even longer, you've got very little chance of getting any of those files back, I'm afraid. You should consider all data on the NAS as lost.
Paying the ransom just paints a bigger target on your back amongst these scumbags, you will be seen as a 'soft target'. Whatever you choose to do, make sure that all of your future interactions with the device happen *offline* whilst it's infected.

This site should give you some useful hints as to the exact method of encryption used:

https://id-ransomware.malwarehunterteam.com/index.php

Thirith

Cheers, that definitely helps to begin with. I think I've already resigned myself to all the data being lost.

Hevach

Kapersky has a edit: apparently now a whole series of tools that can try to crack a .0xxx file, you can feed it something inert like a .txt file and give it a shot, but it's a long shot.

https://noransom.kaspersky.com/

Thirith

Cheers - there's nothing there yet, but I might just shelve the NAS for a few months and then check back.