Skip to content

Suspected attack

Ransomware note, alerts you didn't cause, logins you don't recognize, family reporting weirdness. The estate was designed for this moment: the NAS snapshots are your immutable layer and deep retention is your time machine. Your job is to isolate and preserve — not to fix anything tonight.

Step 1 — Isolate (choose by what you can reach)

  • Lowest-tech, always works: have anyone at home unplug the WAN cable from the router. The house keeps running; the attacker loses reach. Backups continue locally.
  • From any browser: Cloudflare dashboard → Zero Trust → disable the tunnels (kills mc-admin and any public entrances). Tailscale admin console → remove any device you don't recognize.

Step 2 — Freeze the cloud accounts (phone, not borrowed laptop)

In this order:

  1. Google account → Security → sign out of all sessions; review third-party access and revoke anything unfamiliar (this also kills the backup system's Drive token — acceptable; off-site pauses, home backups don't).
  2. Cloudflare → revoke all Access sessions; check for audit-log changes you didn't make.
  3. Tailscale → review devices and keys; revoke anything unknown.

Step 3 — Preserve

  • Do not wipe, "clean", or reinstall anything yet. Compromised machines are evidence and their disks may still hold data the backups missed.
  • Do not delete or "tidy" backups or snapshots — an attacker wants your history gone; don't do their job for them.
  • The NAS-side snapshots (Synology UI → Snapshot Replication) cannot be edited from client machines — they are the recovery floor even if live backup files were encrypted.

Step 4 — Rotate, but only from a trusted device

When you're on hardware you trust (your phone, or home machines verified clean): rotate passwords in dependency order — Google → Cloudflare → Tailscale → UniFi → NAS → then the backup-stack internals (kopia users, the alert topic) which have their own procedure in the backup section.

Step 5 — Recover

Restore order and commands live in Getting things back — VMs from dumps, files from Kopia, machines from Veeam/Time Machine. Restore from snapshots that predate the incident, onto rebuilt or verified hosts, never onto machines you haven't examined.