How to Protect Your UGREEN NAS from Ransomware
Ransomware can encrypt files stored on a NAS. One common path is an infected computer modifying files through a mounted network share using permissions that computer already has. Stolen NAS credentials, exposed services, and synchronization tasks create other paths.
Two-factor authentication and firewall rules reduce the risk of direct account compromise. They do not stop ransomware running on an already-authorized computer from changing files it can access.
Protecting a UGREEN NAS therefore requires three layers: restrict what each account can modify, secure direct access to UGOS Pro, and maintain a clean recovery copy outside the attacker’s control.
How Ransomware Reaches a NAS
Ransomware does not need to install itself on the NAS to damage NAS data. It only needs a path with permission to modify the files.
| Attack path | What happens | Control that changes the outcome |
|---|---|---|
| An infected computer has a writable NAS share mounted | The ransomware encrypts, renames, or deletes every file that the signed-in account can modify | Least-privilege permissions, read-only archives, snapshots, and an independent backup |
| Someone obtains a NAS administrator password | The attacker can change settings, access shared folders, and delete recovery points | Two-factor authentication, account blocking, restricted remote access, and separate backup credentials |
| An exposed or outdated NAS service is compromised | Malicious code reaches the NAS directly instead of through another computer | Software updates, firewall rules, and disabling unused services |
| Encrypted files enter a synchronization or backup task | The destination receives the damaged versions or propagated deletions | Version retention, deletion-aware settings, and isolated recovery copies |
| A malicious file is stored on the NAS | The file remains dormant until a user, computer, container, or application executes it | Endpoint security, Security Manager scanning, and controlled application permissions |
Reduce What an Infected Computer Can Encrypt
Start with the permissions used during normal file access. If one compromised account can write to every shared folder, one infected computer can damage the entire library.
Separate Administrator and Daily-Use Accounts
Reserve administrator accounts for configuration, updates, and recovery. Use a standard account for routine file access.
Do not mount shared folders on a computer with permanent administrator credentials. Ransomware running on that computer inherits the access available through the active session.
Every family member, employee, or regular device should have its own account. Individual accounts make it easier to limit access and identify which credentials were used when files changed.
Match Permissions to the Folder’s Purpose
The correct permission depends on what the user needs to do:
- Give read-write access to active project folders that the user must edit.
- Use read-only access for completed projects, family archives, published media, and reference files.
- Deny access to folders unrelated to that person or device.
- Give automated backup applications a dedicated account restricted to their destination folder.
- Keep application data, computer backups, personal files, and shared media in separate folders.
A television or media player that only streams movies does not need permission to delete or replace them. A family member viewing old photos does not need write access to the entire archive.
Limit Permanently Mounted Shares
A mounted SMB share is convenient because it appears like another drive on the computer. It also remains immediately available to malware running under that user’s account.
Mount only the folders the computer regularly needs. Avoid mapping the root of the NAS or a broad administrator share. Disconnect sensitive archival shares when they are not being used.
Why Two-Factor Authentication Is Not Enough
Two-factor authentication protects the login process. It is valuable when someone steals or guesses a password.
It does not reauthorize every file operation inside an existing SMB session. If an infected computer is already connected to a writable share, ransomware can use that connection without triggering a new two-factor authentication prompt.
Endpoint protection on connected computers remains essential. Keep their operating systems, browsers, applications, and anti-malware tools updated.
Close Direct Paths Into UGOS Pro
Permissions limit an infected user. The next layer reduces the chance that an attacker reaches the NAS directly.
For a broader review of encryption, privacy, accounts, and physical access, see how UGREEN NAS security controls and limitations work together.
Install UGOS Pro and Application Updates
Install security updates for UGOS Pro and applications promptly. An update cannot close a vulnerability until it has been applied.
Remove applications and containers you no longer use. Every running service adds software that must be updated, monitored, and restricted.
Disable FTP, Telnet, SSH, WebDAV, remote access, and file-sharing protocols that your setup does not require. Enable SSH only for a specific administrative task, restrict it to trusted networks, and disable it afterward.
Protect Account Access
Use a unique password for each administrator account. Do not reuse an email, shopping, social-media, or workplace password.
Enable account blocking for repeated failed login attempts. Review trusted devices and active sessions, then remove devices you no longer recognize or use.
UGOS Pro supports time-based one-time passwords through compatible authenticator applications. Follow the dedicated guide to set up two-factor authentication on UGREEN NAS and store the recovery information somewhere other than the NAS.
Restrict Network Exposure
Do not expose SMB port 445 or the UGOS Pro management interface directly to the internet.
Configure the NAS firewall to allow only the services and source addresses your setup needs. Create and test the required allow rules before applying a default deny rule so you do not lock out your own administrative device. The complete procedure is covered in our guide to configuring UGREEN NAS firewall rules.
For remote administration, use a method that does not require publishing the management interface directly. Compare UGREENlink, DDNS, and private-network options in the UGREEN NAS remote-access guide.
Network segmentation can further limit lateral movement in homes or offices with untrusted IoT devices, guest users, or public-facing services. It does not replace folder permissions because an authorized computer can still modify the shares available to it.
What Security Manager Can and Cannot Stop
UGOS Pro Security Manager uses ClamAV malware definitions and provides scheduled scanning, real-time protection, quarantine, trust-list management, and scan records.
Keep the virus database updated. Enable real-time protection and schedule full scans outside periods of heavy backup, indexing, or file-transfer activity. If Security Manager detects a suspicious file, quarantine it and investigate the computer or application that placed it on the NAS.
Security Manager is useful for detecting known malicious files passing through shared storage. It does not scan the memory and processes running on every connected computer, guarantee detection of a new ransomware variant, or restore files that have already been encrypted.
If filenames suddenly change, files stop opening, ransom notes appear, or storage activity increases without an expected workload, isolate the affected systems immediately. Do not wait for a scheduled scan to finish while encryption continues.
Build Recovery Copies Ransomware Cannot Rewrite
Prevention reduces risk. Recovery determines whether an attack becomes permanent data loss.
A usable ransomware recovery plan needs both fast local rollback and an independent copy outside the NAS.
Use Btrfs Snapshots for Fast Rollback
UGOS Pro snapshots protect supported folders only when they are stored on a Btrfs storage space. Open Storage Manager and check the storage space’s filesystem before relying on snapshots. If the storage space uses Ext4, the Snapshot app cannot create snapshots for folders on that storage space.
A non-Btrfs storage space therefore needs an independent, versioned backup as its recovery path.
For folders on Btrfs storage, snapshots preserve point-in-time states without immediately duplicating every file. If ransomware changes or deletes data, a clean snapshot from before the attack can provide a much faster recovery path than downloading an entire off-site backup.
Choose the snapshot interval according to the amount of recent work you can afford to lose. A six-hour interval can leave up to six hours of changes outside the latest recovery point. Active business documents need more frequent recovery points than a photo archive that changes once a week.
Retain multiple recovery points. Ransomware may remain unnoticed while later snapshots capture already-encrypted files.
UGOS Pro can retain snapshots by number or time. When the configured maximum count is exceeded, the system deletes the earliest unlocked snapshot. Snapshots that exceed the configured retention period are also removed. Lock important recovery points when they need to remain outside this automatic cleanup.
Snapshots also consume additional space as protected files change or are deleted. A ransomware event that rewrites thousands of files can make snapshot usage grow rapidly. A scheduled snapshot that exceeds the retention limit can also remove the earliest unlocked recovery point, which may be the last clean one.
After isolating an active incident, pause the snapshot schedule until you have identified and protected the last clean recovery point.
Snapshots Are Not Immutable Backups
UGOS Pro snapshots remain on the same NAS. They cannot protect against theft, destruction of the entire system, or every form of storage failure.
An administrator can also delete snapshots. Locking a snapshot excludes it from automatic retention cleanup, but it does not make the snapshot immutable or prevent deliberate deletion by an administrator.
Snapshots protect well against accidental changes and ransomware operating through an ordinary user’s writable network share. They cannot withstand complete administrator-account compromise.
Snapshots are the fast recovery layer. An independent backup provides the isolation layer.
Keep an Offline or Off-Site Copy
The 3-2-1 principle provides a practical baseline:
- Maintain three copies of important data.
- Store them on two types of storage.
- Keep one copy off-site.
At least one recovery copy should also be offline, isolated, or protected by enforced retention.
For an external-drive backup, connect the drive, complete the backup, verify it, safely eject it, and disconnect it from the NAS. A USB drive left connected remains reachable during an attack on the NAS.
For an off-site backup, use credentials separate from the normal NAS administrator account. Limit the backup credential to the permissions required for its destination. If the same compromised account can modify both the NAS and every backup version, the second location provides little isolation.
Our guide to automating UGREEN NAS backups to the cloud covers supported destinations, backup tools, schedules, encryption, and retention options.
Use Versioning or Object Lock Where Appropriate
Versioning preserves older object versions after a file is replaced or deleted. Retention controls determine how long those versions remain available.
Object Lock adds stronger protection by preventing protected object versions from being overwritten or permanently deleted during the retention period. Amazon S3 requires versioning for Object Lock and supports governance and compliance retention modes, as explained in the Amazon S3 Object Lock documentation.
Creating an Object Lock-enabled bucket does not prove that every backup is protected. Confirm that default bucket retention or the backup application’s retention settings apply to uploaded objects. Test an attempted deletion before relying on the configuration.
RAID and Synchronization Do Not Preserve Clean Copies
RAID 1, RAID 5, RAID 6, and RAID 10 can keep a storage pool available after supported drive failures. They also reproduce destructive file changes across the array. RAID does not retain the clean file that ransomware replaced.
Synchronization keeps locations aligned. If an encrypted file or deletion enters a two-way sync task, that change can propagate to the other location. A synchronized copy becomes a recovery copy only when version retention, immutability, or another isolated backup preserves an earlier state.
The Recycle Bin Is a Limited Safety Net
The UGOS Pro Recycle Bin can recover files that were deleted while the relevant Recycle Bin was enabled. It cannot recover a file that ransomware encrypted or overwrote in place, and an administrator can empty or disable it.
Use the Recycle Bin for convenient recovery from ordinary deletion. Do not count it as a ransomware recovery layer.
Test Recovery Before You Need It
A successful backup job does not prove that the files can be restored.
Use a shared test folder to verify the complete recovery path:
- Add several documents, photos, and other representative files.
- Create a snapshot and run the independent backup.
- Modify some files and delete others.
- Clone the shared-folder snapshot into a separate folder.
- Restore the same files from the independent backup.
- Open the recovered files and confirm their contents.
- Verify that normal file-access credentials cannot delete the protected backup or retained versions.
Cloning is available for shared-folder snapshots. Snapshot restoration overwrites the current folder state and is irreversible, so do not use an in-place restore as your first test.
Repeat the test after changing the backup application, destination credentials, snapshot policy, retention settings, or storage configuration.
What to Do When NAS Files Start Being Encrypted
Treat unexplained mass file changes as an active incident. Rapid isolation matters more than completing the current backup or scan.
- Disconnect the affected computer. Unplug Ethernet and disable Wi-Fi so it cannot continue modifying network shares.
- Isolate the NAS if encryption continues or the NAS itself appears compromised. Disconnect its network connection. If isolation is impossible and destructive activity continues, power down the affected device. Organizations that need forensic evidence should involve an incident-response professional because shutting down a system can erase volatile evidence.
- Pause synchronization, backup, replication, and snapshot schedules. Do not allow encrypted files or deletions to replace clean remote versions, and do not let new jobs age out older recovery points.
- Record what happened. Save the ransom note, changed file extensions, affected usernames, unfamiliar sessions, and the approximate time the changes began.
- Use a known-clean device for account changes. Revoke unfamiliar sessions, disable compromised accounts, reset affected passwords, and replace exposed backup credentials.
- Remove the infection source before restoring files. Scan or rebuild compromised computers, patch exposed services, and remove malicious applications or persistence mechanisms. Restoring while the original ransomware remains active can encrypt the recovered files again.
- Find the last clean recovery point. Identify the earliest ransom note, unfamiliar extension, or confirmed modified-file timestamp. Work backward and select the last snapshot or backup created before that time.
- Inspect the recovery point before restoring. For a shared folder, clone the snapshot into a separate folder. Open representative documents, photos, archives, and other important files. Do not assume the newest snapshot is clean.
- Restore the verified data. Begin restoration only after the affected devices, accounts, services, and credentials have been contained.
- Reconnect systems gradually. Watch for renewed file changes, unfamiliar sessions, and security alerts as each device or service returns.
This sequence follows the isolation, evidence-preservation, backup, and recovery principles in CISA’s StopRansomware Guide.
Should You Pay the Ransom?
The FBI does not support paying a ransomware demand. Payment does not guarantee that you will receive a working decryptor, restore every file, or prevent stolen information from being released. It also rewards the attackers and encourages further attacks. FBI ransomware guidance explains these risks.
Paying is not a recovery plan. Organizations should contact their incident-response provider, legal counsel, and cyber insurer before communicating with an attacker or making decisions that may create legal, regulatory, or financial consequences.
U.S. victims should report ransomware incidents to CISA, a local FBI field office, or the official FBI Internet Crime Complaint Center, regardless of whether a payment has been requested or made. Victims outside the United States should contact the appropriate national cybersecurity and law-enforcement authorities.
Recovery is complete only when the infection source has been removed, the restored files have been verified, and the credentials used during the incident are no longer valid.
