1. Executive Summary: The Synology NAS Threat

A highly sophisticated ransomware campaign is actively targeting Synology Network-Attached Storage (NAS) devices globally. Unlike traditional ransomware that infects a Windows endpoint and encrypts mapped network drives, this malware family (tracked internally by researchers as “soc-sim”) executes natively on the Synology DiskStation Manager (DSM) Linux architecture.

The attackers exploit poorly secured Synology QuickConnect instances, leveraging compromised credentials with disabled Two-Factor Authentication (2FA). Once access is gained, a custom-compiled Go binary is dropped onto the NAS. To maximize speed and avoid detection by standard file-monitoring heuristics, the ransomware utilizes a partial encryption technique—locking only the first 4096 bytes (4 KiB) of each file using XChaCha20.

Victims will find their critical data appended with either the .nsm or .hrr file extension, accompanied by multiple ransom notes (e.g., READ_ME_UNLOCK_FILES.txt). The threat actors operate a double-extortion scheme, claiming to have exfiltrated the NAS data to remote servers prior to encryption, demanding approximately 0.07 BTC or 500 USDT to prevent a data leak.

This exhaustive playbook provides systems administrators and incident responders with a clear roadmap to contain the malware on the NAS, analyze the cryptographic payload, navigate the extortion demands, and execute a systemic recovery operation.

2. Threat Intelligence & Technical Specifications

Because this malware executes natively on the NAS, standard Windows Endpoint Detection and Response (EDR) agents are entirely blind to the attack. Defenders must focus on DSM-level logs and the specific cryptographic mechanics of the Go binary.

3. Anatomy of the Attack: Partial Encryption Tactics

The developers of this ransomware prioritized absolute speed. Full-file encryption on a NAS holding terabytes of video files, backups, or disk images would take days and likely trigger CPU/Disk IO alerts. To circumvent this, the “soc-sim” binary uses Intermittent/Partial Encryption.

• The Header Attack: The ransomware only encrypts the first 4,096 bytes (4 KiB) of the file using the XChaCha20 stream cipher. This effectively destroys the file header, rendering the entire file unreadable to the operating system or native applications.
• The Footer Appended: A 54-byte footer is appended to the end of the newly encrypted file. This footer contains critical metadata, including the original file extension and the original file size, which the decryption routine requires to properly rebuild the file.
• The mTLS API: The locker binary contains an embedded client certificate and private key. It communicates with the attacker’s Command and Control (C2) server API (e.g., https://45.74.7.105:58595) using mutual TLS (mTLS) to retrieve the unique encryption keys.

4. Ransom Note Analysis & Extortion Methods

The threat actors drop highly standardized ransom notes across the compromised volumes. They explicitly threaten data leakage (double extortion) and impose a deadline. Below is the text from the READ_ME_UNLOCK_FILES.txt note.

Hello, What Happened? Your Network-Attached Storage (NAS) has been compromised. What Does This Mean? Where Are My Files? All your data has been encrypted and uploaded to our servers. What Can I Do to Recover My Data? If you want to recover your data, you need to send 0.07 BTC to the following address: 1AC27N1pfknqw1amhaQyaEvU77hLCRL1x9 Always double-check the address when copying and pasting it! What Should I Do After I Send the Payment? Your ID is: [Unique 64-character Alphanumeric String] Please email us your ID and payment confirmation at: [email protected] Any messages other than payment confirmation will be ignored. Please respect your time and ours. After we confirm your payment, you will receive detailed instructions on how to connect to our server and download all your data back. This process does not require any technical skills and is completed quickly. Payment must be made by August 30th. Can I Still Use My NAS? Do not delete any files you find on your NAS. Do not attempt to recover your data using any software, as this may result in permanent data loss. Do not modify any volumes or storage pools on your NAS. Do not write large amounts of data to your disk. Why Have My Files Been Downloaded? We reserve the right to leak or sell all your important documents if payment is not made.

5. Phase 1: Detection & Forensic Triage

Because the attack occurs natively on the Linux-based DSM operating system, standard Windows scripts are ineffective. Administrators must enable SSH on the Synology NAS to hunt for the malicious artifacts.

Actionable SSH/Bash Threat Hunt for Synology DSM

Connect to your NAS via SSH using an administrator account. Run the following commands to identify the extent of the infection and locate the malware binary (often named soc-sim-universal.run):

# ==============================================================================
# Decryptors.org Incident Response: Synology NAS (.nsm / .hrr) Audit
# Target: Synology DSM (Run via SSH)
# ==============================================================================

echo "Starting NAS Ransomware Audit..."

# 1. Search for the malicious Go binary in common drop locations
echo "[*] Searching for soc-sim binaries..."
find /tmp /var/tmp /volume1/@tmp -type f -name "*soc-sim*" -exec ls -la {} \;

# 2. Identify the presence of encrypted files (.nsm or .hrr)
echo "[*] Scanning Volume 1 for encrypted extensions (limiting to 10 results)..."
find /volume1 -type f \( -name "*.nsm" -o -name "*.hrr" \) | head -n 10

# 3. Search for the specific ransom notes
echo "[*] Locating ransom notes..."
find /volume1 -type f -name "READ_ME_UNLOCK_FILES.txt" | head -n 5

# 4. Check active network connections for communication with known C2 IPs
echo "[*] Checking for active outbound C2 connections..."
netstat -anp | grep ":58595"

7. Phase 3: Cryptographic Reality & Recovery Options

Recovering from the “soc-sim” ransomware involves confronting the technical reality of the attacker’s cryptographic implementation.

The Cryptographic Hurdle

Analysis of the attacker’s API confirms that the master decryption keys are held exclusively on their remote server. When the locker executes, it requests a key from https://45.74.7.105:58595/api/v1/ping. Because XChaCha20 is mathematically secure, brute-forcing the key locally is impossible. Unless the attacker’s database is seized by law enforcement or leaked, a free, public decryption tool cannot be created.

Restoring from Immutable Snapshots

If your Synology NAS was configured to use the Btrfs file system and you had Snapshot Replication active, you hold the definitive solution.

• Ransomware executing via standard user/admin privileges cannot delete Btrfs snapshots natively unless they successfully exploit a root escalation vulnerability within DSM.
• Navigate to the Snapshot Replication app in DSM. Select the affected shared folders, click Recover, and browse to a snapshot taken prior to the infection date. You can restore the folder in place or clone it to a new location.

Handling the Extortion

If you lack snapshots or off-site backups, you face a severe crisis. The attackers hold the keys, and their refusal to provide proof-of-decryption is highly concerning. Do not pay the ransom blindly. Threat actors often take the cryptocurrency and disappear, or demand a secondary payment to prevent the data leak. You must engage professional incident response negotiators to vet the threat actors, demand cryptographic proof, and handle the transaction safely if it becomes the absolute last resort.

8. Phase 4: Hardening Synology DSM Environments

A ransomware infection on a NAS indicates a failure in perimeter security and access control. To prevent reinfection or secondary attacks, you must aggressively harden the DSM architecture.

• Mandatory 2FA/MFA: The primary attack vector was compromised credentials. Navigate to Control Panel > Security > Account and enforce 2-Factor Authentication for all users, especially administrators.
• Disable Default Accounts: Disable the default admin account and create a new administrative user with a complex, non-obvious username.
• Restrict External Access: Do not expose your NAS directly to the internet. Disable QuickConnect if it is not strictly necessary. If remote access is required, implement a VPN server (like WireGuard or OpenVPN) on your firewall/router, and access the NAS only through the secure VPN tunnel.
• Enable Immutable Snapshots: Ensure your volumes are formatted in Btrfs. Install Snapshot Replication and configure immutable snapshots (Snapshot Protection) so they cannot be deleted by unauthorized users, even those with standard admin rights, for a set retention period.
• Isolate Backups (The 3-2-1 Rule): Your NAS is not a backup if it is your only copy of the data. Use Hyper Backup to push encrypted copies of your data to an off-site, air-gapped cloud provider (like Synology C2 or Amazon S3) that supports object lock/immutability.

The .nsm / .hrr NAS ransomware represents a highly sophisticated, targeted threat employing native Linux execution and partial encryption tactics. Navigating this crisis requires a cool head, adherence to strict incident response frameworks, and a methodical approach to containment. Should this playbook highlight gaps in your current defensive posture, treat it as a mandate to immediately overhaul your storage architecture.