nampohyu on Readynas

---

bdmoy wrote:

Hello,

 

I have a ReadyNAS at work running the 6.9.5 firmware and I have currently ran into the NamPoHyu ransomware virus as well. On some of my shared folders I an see files with a 1.pdf.nampohyu file extension and I also see some !DECRYPT_INSTRUCTION.TXT files. What do I do to get rid of this virus?

---

This isn't exactly a virus.  You've allowed public access to your NAS shares over the internet, and someone has taken advantage of that mistake.

So the first step is to stop allowing that public access.  If the NAS is set up in the DMZ of your router, then change that setting.  Also don't forward ports 137,138,139, and 445 to your NAS.  If you must forward SMB, then make sure that you don't allow anonymous access and that you are using strong passwords.

After that, clean up the damage.  Emisoft recently released a free decrypter for Megalocker/Nampohyu that you could try using to recover your files: https://www.emsisoft.com/decrypter/megalocker It doesn't look like there is a version for Mac though, you'll need to run it under Windows.  I haven't used this, or seen much posted about it.

Alternatively restore the lost files from a backup or a NAS snapshot (deleting any files left behind by the attacker).