Data Recovery After Ransomware on Servers & NAS

The most globally active ransomware group. Encrypts Windows and Linux servers, ESXi virtual machines and shared volumes. Uses AES-256 + RSA-2048 encryption. The executable is deployed via Active Directory GPO to encrypt all domain machines simultaneously.

Written in Rust, cross-platform (Windows, Linux, ESXi). Known for «double extortion»: encrypts data and threatens to publish it. Specifically targets ESXi VMFS volumes and Hyper-V VHDX to paralyse the entire virtual infrastructure.

Specialises in exploiting file transfer vulnerabilities (MOVEit, GoAnywhere). Exfiltrates data massively before encrypting. Affects file servers, SQL databases and shared volumes on enterprise NAS.

Relatively new ransomware targeting SMEs through Cisco VPN without MFA. Encrypts Windows servers, Linux and NAS. Particularly aggressive with backups: actively seeks and destroys backups before encrypting production data.

Specific to QNAP and Synology NAS exposed to the internet. Encrypts files at the shared folder level with AES-128. Files appear with the .deadbolt extension. The NAS login page is replaced by the ransom note. Exploited vulnerabilities in QTS and Photo Station.

QLocker uses 7-Zip to compress QNAP NAS files with a password. eCh0raix attacks Synology and QNAP NAS via SSH brute force or known vulnerabilities. Both are less sophisticated than LockBit but equally destructive to victim data.

We analyse the ransom note, file extension and encryption patterns to identify the exact variant. We consult decryptor databases (No More Ransom, ID Ransomware) in case a public decryption tool exists.

Many ransomwares attempt to delete Windows Volume Shadow Copies (VSS), but do not always succeed 100%. We analyse the volume at disk level looking for residual shadow copies. On NAS, we look for Btrfs/ZFS snapshots that may have survived.

If the server uses RAID, we clone all disks and virtually reconstruct the array. In many cases, the original (unencrypted) files remain in unoverwritten RAID sectors, especially if encryption was partial or interrupted.

Ransomware typically encrypts in-place (overwrites the file) or encrypt-and-delete (creates encrypted file + deletes original). In the second case, the original file remains on disk until its space is reused. Recovery via carving and journal analysis is viable.

We maintain an updated database of public decryption keys and tools. When law enforcement dismantles a group (Hive case, LockBit case), keys are published. We check every case against available keys.

Encrypted VMDKs on ESXi, encrypted VHDXs on Hyper-V. If the ransomware partially encrypted the VMFS datastore or if VM snapshots exist from before the attack, VM content recovery is viable. We also recover VMs from encrypted Veeam/NAKIVO backups.

Synology, QNAP, WD My Cloud with shared folders encrypted by DeadBolt, QLocker, eCh0raix. Recovery via residual Btrfs snapshots, previous versions in @Recently-Snapshot, or carving of unoverwritten files in the file system.

SQL Server (.mdf/.ldf), MySQL, PostgreSQL. Databases tend to be large files that ransomware encrypts partially (only the first few MB). Reconstructing unencrypted data pages allows recovery of a high percentage of records.

Veeam (.vbk/.vib), Acronis (.tibx), Windows Server Backup, Time Machine. Attackers actively seek and destroy backups. If backups were on separate volumes, offline or with immutability enabled, they may be the primary recovery path.