群晖再次遭遇勒索病毒

木谷高明

红迪原贴（15小时前）

I only have time to check on the following during my morning coffee session before heading out for work..

- confirmed ransomed by L0CK3D

- the ransom is committed by root

- NAS been put into a ‘fresh’ state— all apps were installed, but no launcher in the menu

- saw libgittcb.bat in resources monitor, but seems no quick way to terminate it

- no weird root tasks in task scheduler

- no login attempts (from SMB nor DSM) on any other accounts, seems like root just tap in from nowhere and let loose…

- I only have enough time to download and run Antivirus Essentials before I have to go…

Some background info..

- the NAS is in my parents house (cross country).

- I have snapshots enabled and weekly to monthly backups (to different cloud locations) for those irreplaceable contents (e.g., family albums over decades). While the rest of the data is downloadable and hopefully rebuildable

- all admins accounts are MFA-ed either by TOTP or Synology’s Secure SignIn

My gut feeling tells me to NOT reboot it, as the system might have been somewhat broken by the ransomware.. furthermore I can’t even checked on Snapshots and backup status since it has been ‘refreshed’

没有SMB文件共享和DSM管理页面登录记录，所有管理员都启用了MFA多因子认证，快照全部被删除。

2017.05.04

看了下原因都是停留在DSM 7.2.1版本并且对互联网暴露登录页，好多年前的老问题了
还有个高手直接对公网开ssh

wfhtony

咱这边的白群刚刚简单扫了眼，暂时没受到影响，版本号：7.3.2-86009 Update 4
不过这倒是提醒咱该升级到7.4.1了（

附那位reddit老哥的机型和系统版本：

Model: DS1621+, running 7.2.1 69057 Update 9

catxing

2017.05.04 发表于 2026-10-29 09:23
看了下原因都是停留在DSM 7.2.1版本并且对互联网暴露登录页，好多年前的老问题了
还有个高手直接对公网开ss ...

搜了下，2年多前的版本，说实话不冤

Deco

对公网直接暴露，哈哈哈

Alufer

我用的蜗牛星际的黑裙，还停留在DSM6

2017.05.04

Alufer 发表于 2026-10-29 10:45
我用的蜗牛星际的黑裙，还停留在DSM6

可千万别暴露给公网，不然怕是一秒破防

Alufer

草了，现在要换个正品NAS吗，还是刷个飞牛之类的更好一点