NAS and RAID Ransomware Recovery: Synology, QNAP and Server Arrays

A NAS or a RAID array is where most of a company's shared files, databases and backups live, which is exactly why ransomware goes after it. Recovery depends on how the ransomware reached the storage, and there are three very different cases: ransomware that ran on the NAS itself, ransomware on a Windows PC or server that encrypted the files on the NAS's shares over the network, and ransomware that encrypted the servers whose disks sit on a RAID array.

Some ransomware is written for NAS boxes and attacks them directly over the internet: Qlocker (2021) moved the files on QNAP devices into password-protected 7-Zip archives, eCh0raix hit QNAP and Synology devices for years, and DeadBolt (2022) exploited a vulnerability in internet-facing QNAP and ASUSTOR devices and replaced the login page with its ransom note. Today the larger groups more often reach the NAS from inside the network with stolen administrator passwords.

The first place to look is the NAS's own snapshots. Synology (Btrfs) and QNAP snapshots are read-only copies of the shares, and if the attacker did not delete them, they are the fastest way back. Do not delete or roll back snapshots in a hurry: copy what is in them first.

The second is the deleted originals. When ransomware writes an encrypted copy and deletes the original, as Qlocker did with its archives, the original data stays on the disks until it is overwritten, and some Qlocker victims got files back exactly that way. That is why the NAS must be switched off and not used: every new write can land on the space of a deleted original.

Most often the NAS was never infected at all: ransomware running on a Windows PC or server encrypted every share it could reach. Then the NAS itself is healthy and the result looks like any other ransomware case: the files on the shares are encrypted one by one, with the family's extension.

What can be recovered is the same as on a server: snapshots, previous versions and backups that the account used by the ransomware could not reach, and, for large files such as databases, virtual disks and backup files on the share, the parts that were not encrypted. Many current encryptors encrypt large files only in part.

When the servers are encrypted, the RAID array underneath is usually intact: the ransomware encrypts files, not the array. The danger comes afterwards, when someone re-creates the array, re-initialises the controller or reinstalls the server onto the same disks, which can overwrite exactly what recovery needs.

The right order is the opposite: take an image of every member disk, rebuild the array virtually from the images, and then recover from the volume on it, the databases, virtual disks and backups, the same way as on any other server. AS RAID Recovery detects the RAID level, stripe size, parity rotation and disk order by itself and works only from images or read-only disks; it is tested on 22 RAID layouts, including RAID 5 with a missing disk, RAID 6 and RAID 10, against the original data.

Synology and QNAP use Linux software RAID, and AS RAID Recovery reads its metadata and rebuilds the array with the exact layout. Inside the array the volumes are usually ext4 or Btrfs. The program saves the rebuilt array as one disk image, but it does not yet read the files inside ext4 and Btrfs volumes; that is done by our NAS recovery service. On Windows-formatted volumes (NTFS, exFAT, FAT32) the program recovers the files itself.

Switch the NAS off, or at least disconnect it from the network, and do not log in to its web interface to "look around": some NAS ransomware runs on the device itself. Do not delete, roll back or let retention remove snapshots, do not re-create the array or reinitialise disks, and do not run a filesystem repair.

Keep the ransom note and a few encrypted files. Then establish what is recoverable, from snapshots, deleted originals and the unencrypted parts of large files, before deciding anything else.