A listed decryptor helps only when the strain and build match your files, and none of the groups named in Coveware’s Q3 2026 ranking appears in the catalogue you pasted. The dependable recovery for a NAS is a snapshot or offline copy the attacker could not reach, which is also the answer to how your files should have stayed safe.
Pull the network cable from the NAS, leave the ransom note and every encrypted file untouched, and read the list you pasted as a lookup table rather than a rescue. It is the No More Ransom catalogue, and each entry pairs one ransomware family with a tool built by a security company or a police force. A tool helps only when the strain, and often the exact build, matches the one that hit your files. Coveware’s Q3 2026 report names The Gentlemen, Inc Ransom, FulcrumSec, Qilin and ShinyHunters in its market-share table, and none of them appears on your list. The same report says nearly 80% of the incidents it handled ended without a ransom payment. The recovery that works for a NAS is a copy the attacker could not reach, and that copy is also the honest answer to your second question about how the files should have stayed safe. This analysis follows that order: contain and identify the strain, test whether a free tool exists, settle payment and reporting, then rebuild the NAS so the next intruder meets an immutable snapshot and an offline copy instead of your only data.
Unplug the NAS and preserve the evidence before anything else
The joint response checklist from CISA, the FBI, the NSA and MS-ISAC puts isolation first. Work out which systems were hit, then take them off the network at once, either at the switch or by pulling the Ethernet cable and removing the device from Wi-Fi. The checklist allows powering a device down only when it cannot be disconnected, because a shutdown destroys the memory contents that hold evidence of the infection. Pull the network cable first. If file names keep changing after the cable is out, the encryption is running on the NAS itself, and switching it off becomes the safer call. That reading is an editorial judgment, not CISA’s wording.
The checklist adds two habits that suit a home user as much as a company. Attackers who still have access may be watching mail and chat for signs that they were noticed, so agree the next steps by phone rather than through accounts the intruder could read. And the incident is not over when the files stop changing, because a ransomware event can be the last step of an earlier, unresolved compromise.
CISA also advises triage. Identify and prioritise the systems whose restoration matters most, keep track of machines that seem unaffected so they can wait, and read antivirus and endpoint logs for earlier malware, because ransomware is sometimes dropped to hide an older compromise. Applied at home, list every PC, phone and drive that ever mounted the NAS and treat each one as a suspect until it has been scanned.
Preservation comes next. Keep the ransom note, several encrypted files and, if you can, the original file timestamps, and do not format, reset or reinitialise the NAS until you know whether your strain is decryptable. The researcher who broke one Akira variant in 2025 wrote that all hope of recovery is gone once the original timestamps are unknown, because his method brute-forces them. Keep the ransom note and the encrypted files untouched, and make a copy before any decryptor runs against them. That last precaution is editorial advice, not a rule from the sources.
Strain identification decides which tool you may run
No More Ransom organises its tools by family, so the first task is a name. The project’s Crypto Sheriff is designed to define the type of ransomware on your device so that the site can check whether a decryption solution exists. ID Ransomware, a free service created by Michael Gillespie of the Malware Hunter Team, takes a ransom note and one encrypted file and compares them with known families. Gillespie told Emsisoft that it works from the ransom note’s file name, email and Bitcoin addresses printed in the note, the pattern of the encrypted file names and, for some families, byte patterns inside the files. A positive match returns a plain status on whether decryption is known. He also said that new strains sometimes mimic others, which is the usual reason a lookup gives a wrong answer. Upload the ransom note and one encrypted file that is not confidential.
Once you have a name, the catalogue entry gives you a vendor tool and a how-to guide, and the page carries a warning that outranks the download button: remove the malware from the system first, or it will lock the system or encrypt files again. The catalogue is also organised by tool rather than by attack. Kaspersky’s Rakhni Decryptor appears under more than a dozen family names, from AES_NI and Dharma to Maze, so a name on the list can point to a shared tool rather than a dedicated one. Read the guide for your entry before you run anything. Emsisoft’s write-up warns against diagnosing the infection yourself and against downloading assorted tools in the hope that one fits, which in its words only makes matters worse.
A listed name is a lookup result, not a rescue
The project’s own Q&A explains why free decryption exists at all, and all three reasons are accidents of someone else’s work. The malware authors made an implementation mistake, as with Petya and CryptXXX. The authors published their keys, as happened with TeslaCrypt. Or police seized a server holding keys and shared them, as with CoinVault. The same page adds that the project sometimes receives only a subset of the keys, which is why it tells victims whose tool fails to keep checking back. A matching name does not guarantee that your files are recoverable; it says that someone once found a flaw or a key for some build of that family.
Akira shows how short that window can be. According to the researcher Yohanes Nugroho, a bug in an Akira build from before mid-2023 let Avast write a decryptor, and the group updated its encryption once Avast published it. The Linux and ESXi build active since late 2023 yielded only to a brute-force attack on nanosecond timestamps, run on rented graphics cards, which required the original file timestamps, known plaintext and ciphertext, and money; he reports spending about $1,200 on development and experiments. He later added that a newer Akira version cannot be decrypted with his method, and he judges that almost every ransomware case is unrecoverable without the attacker’s key.
LockBit 3.0 shows the other model. The listed tool, built by Japanese police, is packaged as a decryption checker, and the FBI said in 2024 that it held more than 7,000 LockBit decryption keys and asked victims to come forward. Help therefore depends on whether your case matches a key that investigators already hold. That is an inference from the tool’s design, not a statement in the sources.
CISA’s checklist adds a procedural point: consult law enforcement about available decryptors even when you can mitigate on your own, because security researchers may have found encryption flaws and released tools that are not yet widely known. For a household in Slovakia that conversation can start with the police report described below, which is an editorial suggestion rather than something the checklist spells out.
The groups behind this autumn’s attacks are mostly absent from the list
Coveware, the incident-response firm now part of Veeam, publishes the most recent view of who is attacking. Its report of 28 October 2026 found no dominant actor in the third quarter: The Gentlemen and unaffiliated lone actors each held 6% of cases, Inc Ransom 5%, and FulcrumSec, Qilin and ShinyHunters 4% each. Coveware concludes that chasing individual group names is a losing strategy. Checking the five named groups against the catalogue you pasted turns up none of them, so an attack by any of those groups would reach you with no listed tool.
Two limits keep that from becoming a prediction about your case. The figures describe incidents Coveware supported, where the median victim company had 1,121 employees, so they say little about the odds facing a household NAS. And a missing name proves only that no tool is listed today; a family can enter the catalogue after investigators obtain keys, as the project’s own history of TeslaCrypt, CryptXXX and CoinVault shows.
The catalogue is strongest against older material, and your list shows it. TeslaCrypt, CryptXXX and CoinVault are the families the project itself cites as early successes. Modern entries exist, among them Akira, LockBit 3.0, Black Basta, Rhysida and Phobos or 8base, but their tools come from police work or from research on a specific build. Coveware also found that third-quarter attacks leaned away from encryption: data exfiltration appeared in 71% of cases, while impact, meaning encryption or a service interruption, appeared in 50%. By implication, roughly half the cases involved no encryption or outage at all, and there was nothing to decrypt.
Paying is the weakest recovery option, and the police report costs nothing
No More Ransom says paying is never recommended: nothing guarantees a working key, a bug in the malware can leave data unrecoverable even after payment, and payment proves to criminals that the business model works. Coveware’s third-quarter data puts the choice in proportion. Nearly 80% of incidents ended without a ransom payment, while the payments that did occur had a median of $400,000 and an average of $1,025,278, sums out of scale for a household and heavy even for a small firm.
Backups decide how much pressure a victim feels. Sophos’s 2024 survey of 2,974 organisations found that firms whose backups were compromised paid the ransom 67% of the time, against 36% for firms whose backups survived, and their median recovery cost was $3 million against $375,000. Only 26% of the first group had recovered fully within a week, against 46% of the second. Payment also fails to close the second problem. Coveware warns that promises to delete stolen data cannot be verified, and its report says leaked chat logs from the Silent Ransom Group exposed victims who had paid for silence. Law enforcement said LockBit kept stolen data even from organisations that paid. Assume the files were copied, since data exfiltration appeared in 71% of Coveware’s third-quarter cases. If the NAS held other people’s personal data, check your breach-notification duties, which CISA’s checklist treats as part of the response.
Report the attack. For Slovakia, No More Ransom’s reporting page links to a Ministry of the Interior page, and it advises a visit to the local police station wherever no dedicated online route exists. The project’s Q&A lists server seizures by law enforcement as one of three ways keys become public, so investigators are the party most likely to produce a new tool.
Exposed ports, stolen logins and old firmware are the usual doors into a NAS
Coveware’s breakdown of initial access shows attackers preferring identity over exploits. Phishing and social engineering led at about 29%, remote access compromise followed at 22 to 23%, compromised credentials at 14 to 15%, and exploitation of unpatched software appliances and edge devices at 11 to 12%. Coveware notes that these intrusions resemble ordinary logins, which lets the attacker move quickly and quietly once inside.
NAS devices have their own documented pattern. QNAP’s advisory of 3 September 2022 describes a DeadBolt campaign that appeared to target QNAP NAS units running Photo Station with internet exposure, traced to CVE-2022-27593 and fixed in later Photo Station versions. Censys counted 4,988 DeadBolt-infected services among roughly 130,000 QNAP devices visible on the internet on 26 January 2022, about 3.8% by simple division. A Digital Shadows analyst quoted by Censys tied much of the activity against QNAP devices to UPnP, the protocol that lets devices open router ports on their own. QNAP’s remedy was to disable router port forwarding and UPnP, reach the NAS through its myQNAPcloud service instead of a published port, keep firmware and applications current, and use strong passwords.
A NAS is not always the machine that was breached. CISA’s checklist describes the case where server-side data is encrypted by an infected workstation: the NAS only serves files, and a laptop with a mapped share does the damage over the network. Its quick-identification steps are to review the sessions and open-files lists on the server, read the file properties of encrypted files or ransom notes for the owning user, and check the Windows security and SMB event logs for the authentication that came first. On a NAS, the owner of the first ransom note and the connection log in the administration panel give the same clue, which is an editorial adaptation. The answer tells you which PC to wipe before the NAS is reconnected.
CISA’s guide generalises the same advice. Do not expose remote services such as RDP, block TCP port 445 at the internet perimeter, patch internet-facing systems first, use phishing-resistant multifactor authentication and unique passwords of at least 15 characters, and lock accounts after repeated failures. Before restoring anything, work out which door was used. CISA’s checklist tells responders to identify the accounts and systems involved in the initial breach, rebuild from clean images and reset passwords, because a restore onto an unchanged NAS invites the same intruder back.
The limits of snapshots, backups and the evidence behind them
Backups do not undo theft. Coveware’s report says data that has already left the network cannot be recovered, and exfiltration appeared in 71% of its third-quarter cases, so a perfect restore still leaves an extortion and notification problem. Keeping intruders out stays necessary in its own right, and backup discipline cannot replace it.
Backups can also be a target. Sophos found that 94% of organisations hit by ransomware said attackers tried to compromise their backups, and 57% of those attempts succeeded. Its advice is blunt: if backups are reachable online, assume attackers will find them. A second copy on the same network under the same administrator login therefore guards against a failed disk and little else, which is an editorial reading of that finding.
The protective features have limits of their own. Synology’s specification confines snapshots to Btrfs shared folders and immutable snapshots to supported models, requires at least 100 MB of free volume space to take a shared-folder snapshot, and does not let WriteOnce shared folders use Restore to this snapshot. One limitation works in your favour: while a replication task exists, the latest snapshot replicated to the destination cannot be deleted, which keeps one clean version off the box. CISA warns that cloud immutable storage may fail some regulatory criteria and that a misconfiguration can impose a heavy cost. Recovery itself can go wrong, since CISA tells responders to avoid re-infecting clean systems during restoration.
Finally, weigh the sources. Sophos surveyed organisations with 100 to 5,000 employees and sells security services, Coveware reports on cases that reached an incident-response firm owned by a backup vendor, and Synology and QNAP describe their own products. Their direction of travel agrees with CISA, which has no product to sell, and that agreement is the better reason to trust the advice than any single figure.
A NAS configuration built to survive the next attack
For a home user or a small office with one NAS, the evidence points to five settings, ordered by how much they change the outcome.
First, give the NAS no route from the internet. Remove router port forwarding, switch UPnP off and reach the box through a vendor relay or a VPN, as QNAP’s advisory instructs. Second, patch the firmware and every installed app on a schedule, because QNAP’s fix for the Photo Station flaw only protects devices that install it. Third, protect the logins with a unique admin password of at least 15 characters, multifactor authentication wherever the platform offers it, and lockout after failed attempts, all from CISA’s guide.
Fourth, add snapshots that cannot be deleted from the same login. On Synology, schedules can run as often as every five minutes, immutable snapshots exist on supported models, and snapshots can be replicated to a remote server with the traffic encrypted. Check your own model against the vendor’s support list. Fifth, keep a copy outside the NAS’s reach, following Veeam’s 3-2-1-1-0 rule: three copies, on two kinds of media, one off-site, one immutable or air-gapped, and zero errors when restores are tested. CISA’s wording is shorter: offline, encrypted backups, tested regularly.
Small offices carry two extra duties. CISA tells organisations to keep an incident response plan with a hard copy and an offline version, and to check how any third party or managed service provider that looks after backups handles them, fixing the security requirements in contract language, because providers have been an infection route for ransomware. Coveware lists clear isolation authority among the three things resilience depends on, so decide before an incident who may pull the cable and who calls the police, and write the answer down where it survives an encrypted file server.
The restore test is the step most people skip. Sophos recommends practising recovery so that the process is familiar, and the zero in 3-2-1-1-0 means a backup counts only after a restore has worked. Put a date for the test in the calendar when you set up the schedule.
Decryptor catalogues will trail the attackers, so the backup decides
Free decryptors will keep arriving, and they will keep arriving late. The pattern is visible in the sources. Akira changed its encryption after Avast published a fix, the researcher expects it to change again, and No More Ransom’s own explanation of its keys depends on someone else’s error, someone else’s disclosure or a police seizure. Coveware’s third-quarter report anticipates that some groups may return to simpler encryption-based tactics because pure data extortion produces volatile results. This forecast is analysis, not certainty, but it points toward a catalogue that stays a step behind encrypting attacks.
For your own files the judgment is conditional. If ID Ransomware names a listed family and the entry’s guide says your build is covered, run the tool on a copy and expect a real chance. If the strain is not listed, keep the encrypted copy and the ransom note, check No More Ransom again as new keys appear, and restore from the best clean snapshot or offline copy you can verify. Do not pay on the strength of a promise to decrypt or to delete, since Coveware and law enforcement describe such promises as unverifiable.
Three observations would change this judgment: a published key for your strain, evidence that stolen data has been released, or proof that your clean copy was altered. Until one of them appears, the order of work stands. Isolate, identify, look up, restore, then close the door the attacker used and add an immutable copy. Rebuilt that way, the NAS answers your second question for itself: it should have stayed safe behind a closed network edge, patched firmware, protected logins and a snapshot the attacker could not delete.
Ransomware recovery questions on decryptors, payment and NAS protection
No. The catalogue lists tools family by family, and a tool works only when your strain, and often your exact build, matches. The project says it sometimes holds only a subset of the keys for a family, so a failed tool is a reason to check back later rather than a final answer.
CISA’s checklist says to isolate first, by pulling the network cable or removing the device from Wi-Fi, and to power a device down only when disconnecting is impossible, because shutdown erases memory evidence. If files keep changing after the cable is out, the encryption is running on the NAS itself and switching it off is the safer call, which is an editorial judgment.
Upload the ransom note and one encrypted file that is not confidential to ID Ransomware, or use the Crypto Sheriff on the No More Ransom site. ID Ransomware compares the note’s file name, email and Bitcoin addresses, the encrypted file names and some byte patterns with known families.
Not before the malware is removed, because the catalogue warns that leftover malware will lock the system or encrypt files again. Read the how-to guide for your entry and, as editorial advice, run the tool on a copy of the encrypted files rather than on the only originals.
No More Ransom advises against paying, since a key is not guaranteed and a bug can leave data unrecoverable even after payment. Coveware reports that nearly 80% of the incidents it handled in Q3 2026 ended without a ransom payment.
They may have been. Coveware saw data exfiltration in 71% of its Q3 2026 cases, and data that has left the network cannot be recovered by a backup. If the NAS held other people’s personal data, check your breach-notification duties.
The police. No More Ransom’s Report a Crime page links Slovakia to a Ministry of the Interior page and tells victims in countries without a dedicated online option to go to the local police station.
Only when the attacker cannot delete them. Sophos found that 94% of ransomware victims saw attempts to compromise their backups and that 57% of attempts succeeded. Immutable snapshots, available on supported Synology models, and snapshots replicated to a remote server address that risk.
It is Veeam’s extension of the 3-2-1 rule: three copies of your data, on two kinds of media, with one copy off-site, one copy immutable or air-gapped, and zero errors when the backups are verified by test restores.
The sources point to four routes: phishing or social engineering, remote access compromise, stolen credentials, and unpatched devices at the network edge, plus a PC that mapped the NAS share. QNAP’s 2022 DeadBolt advisory involved NAS units exposed to the internet. Only the logs on your devices can say which route you faced.
Author:
Jan Bielik
CEO & Founder of Webiano Digital & Marketing Agency
This article is an original analysis supported by the sources cited below
Decryption Tools
The No More Ransom catalogue of family-by-family decryptors, which supplied the tool makers, the warning to remove malware first and the LockBit 3.0 decryption checker built by Japanese police.
Ransomware: Q&A
The project’s account of the three ways free decryption becomes possible, its advice against paying and its description of the Crypto Sheriff identification tool.
Report a Crime
The country-by-country reporting routes, including the Slovak Ministry of the Interior link and the local police station fallback.
I’ve Been Hit By Ransomware!
CISA’s response checklist covering isolation, evidence preservation, triage, threat hunting, workstation-driven encryption and restoring from offline backups.
#StopRansomware Guide
The joint CISA, FBI, NSA and MS-ISAC prevention guidance on offline backups, multifactor authentication, patching, exposed services, SMB port blocking and third-party providers.
The Silent Ransom Group Leak Shows Why Paying for Silence Fails
Coveware’s Q3 2026 data on ransom amounts, group market share, initial access vectors, data exfiltration and the share of incidents resolved without payment.
The Impact Of Compromised Backups On Ransomware Outcomes
The Sophos survey of 2,974 organisations that measured backup compromise rates, payment rates, recovery costs and recovery times.
DeadBolt Ransomware Security Advisory QSA-22-24
QNAP’s 2022 advisory on the DeadBolt campaign against internet-exposed NAS devices, with its CVE reference and six-step hardening list.
Beware potential ransomware attacks on QNAP NAS products
Censys’s count of DeadBolt-infected QNAP devices and an analyst’s account of how UPnP exposure fed the attacks.
Snapshot Replication Technical Specifications
Synology’s specification of snapshot prerequisites, immutable snapshot support, replication behaviour and limitations.
Decrypting Encrypted files from Akira Ransomware (Linux/ESXI variant 2024) using a bunch of GPUs
The researcher’s account of how an earlier Akira build was decryptable, how the group changed its encryption and what his brute-force method required.
FBI Says It Has 7,000 LockBit Ransomware Decryption Keys
The FBI statement on its recovered LockBit keys, the pointer to the Japanese police decryptor and law enforcement’s finding that stolen data was retained even after payment.
What is the 3-2-1 Backup Rule?
Veeam’s definition of the 3-2-1 rule and of its 3-2-1-1-0 extension with an immutable copy and verified restores.
How to identify your ransomware infection to find the right decrypter tool
Emsisoft’s interview with the creator of ID Ransomware on how identification works, why new strains mimic older ones and why guessing at tools backfires.
| Citing this article? Brief excerpts are welcome. Please credit Webiano.digital, name the author where stated, and include a link to https://webiano.digital and to this original article. Full or substantial republication requires prior written permission. Read our Copyright and Content Use Policy. |
This article was prepared with the assistance of artificial intelligence tools. The content underwent expert human review, and Webiano Digital & Marketing Agency assumes editorial responsibility for its final version and publication.
