Ransomware protection
Ransomware Guard
We stop an attack before it spreads. Ransomware Guard monitors your storage in real time and launches the defense on its own when encryption is attempted. Immutable backups make sure you always have something to restore from.
Why passive protection isn't enough
Snapshots and backups help you after an attack. But while the attack is running, every second means more encrypted files.
Snapshots are passive
They protect a past state but don't stop an attack in progress.
Encryption spreads over the network
One infected PC encrypts everything it can reach through shared folders.
Humans react slowly
Attacks come at night and on weekends. Hours pass before anyone notices.
Every minute counts
The longer an attack runs, the more data must be restored and the longer the outage.
Active Ransomware Guard & Auto-Isolator
If an attacker or an encrypted PC starts mass-modifying files, Guard detects it within 50 milliseconds and launches the defense on its own. Standard storage offers no such active kill switch by itself.
Similar protection is offered by enterprise systems such as NetApp (Autonomous Ransomware Protection) in solutions costing tens of thousands of euros. Ransomware Guard also blocks the attacker and disconnects shares on its own.
- 01
Detection
Catches suspicious file changes within 50 milliseconds.
- 02
IP block
Immediately blocks the attacker's IP address via API.
- 03
Shares disconnected
Disconnects SMB/NFS shares so encryption can't spread.
- 04
Emergency snapshot
Takes an instant snapshot of the last clean state.
- 05
Urgent alert
Notifies you and us via Telegram or SMS.
An attack at 3 a.m.
The same attack, two different outcomes.
Without active protection
- Encryption runs all night unnoticed
- It gradually hits every shared folder
- You find out in the morning when no one can work
- Restoring large volumes of data takes hours to days
With Ransomware Guard
- The attack is detected within milliseconds
- The attacker is blocked and shares disconnected
- An emergency snapshot preserves a clean data state
- An alert arrives instantly - to you and to us
What Guard watches
It continuously evaluates storage activity and reacts to patterns typical of ransomware.
Mass changes
Unnaturally fast overwriting and renaming of files.
Suspicious extensions
Files suddenly getting unknown extensions.
Source of changes
Which computer or IP address is causing the changes.
Network shares
Activity on SMB and NFS shares through which encryption spreads.
How an attack unfolds
Modern ransomware doesn't start with encryption. First, the attacker makes sure you have nothing to recover from.
- 01
Initial access
Phishing, a vulnerable VPN or a stolen password.
- 02
Taking control
The attacker gains administrator rights and maps the network.
- 03
Attacking backups
Deletes or encrypts backups and snapshots.
- 04
Encryption and extortion
Encrypts servers and threatens to publish stolen data.
Backups are the first target. That's why they must withstand even an attacker with administrator access.
Immutable backups as a safety net
We store backups and snapshots in WORM mode (Write Once, Read Many). Once written, they cannot be modified or deleted for the configured retention period - not by an administrator, not through the API.
Built into storage
Immutable snapshots (Btrfs) and WriteOnce (WORM) shared folders in Synology DSM.
A copy in the cloud
S3 Object Lock in Compliance mode - a copy outside your infrastructure.
14-30 day lock
Typical lock period for daily backups. Monthly backups are locked for longer.
The 3-2-1-1-0 rule
A proven backup standard. Synology Snapshot Replication and Hyper Backup provide a copy at a second site or an EU data center. Data is encrypted in transit and at rest, and the keys stay with you.
What happens during an attack
When an attack hits, nobody improvises. We follow a prepared runbook.
- 01
Detection
We catch suspicious activity and contact you immediately.
- 02
Isolation
We disconnect affected systems so encryption can't spread.
- 03
Recovery point
We find the last clean snapshot before the attack began.
- 04
Recovery
We restore data and servers according to the runbook.
- 05
Analysis
We find out how the attacker got in and close that path.
Which package includes it
Ransomware Guard is part of the Ransomware Shield Pro and Smart Processor packages. Data Shield provides a solid foundation with immutable backups.
| Data Shield | Ransomware Shield Pro | |
|---|---|---|
| Synology storage set up turnkey | ||
| Backups of servers, PCs, virtual machines and Microsoft 365 | ||
| Immutable (WORM) backups | ||
| Encrypted off-site copy (Synology C2) | ||
| Ransomware Guard - automatic attack shutdown | ||
| Instant SMS/Telegram alerts | ||
| Quarterly recovery test with a report |
Why not to pay the ransom
Paying may look like the fastest way out. In practice, it brings more risks than certainty.
No guarantee
The decryption tool may not work at all or only partially, and recovery is often slow.
Stolen data stays stolen
Paying does not guarantee the attacker will delete the data or not sell it on.
Repeat target
A company that paid once often becomes a target again.
Legal risk
Payment may breach sanctions rules if the group is on a sanctions list.
FAQ
Can Guard block normal work by mistake?
We tune the rules to your company's normal operations so they distinguish an attack from legitimate work such as bulk copying. If an intervention ever blocked legitimate activity, we release it remotely after verification.
Does Ransomware Guard replace antivirus?
No, it complements it. Antivirus protects computers; Guard protects storage. When an attack gets past antivirus, Guard stops it at the data level.
Does Guard work on our existing Synology?
In most cases, yes. Before deployment we review the model and system version and advise whether any changes are needed.
Isn't cloud sync, such as OneDrive, enough?
No. Sync uploads encrypted files to the cloud too. You need a separate, immutable backup with version history, separated from everyday accounts.
What if an attacker gets the administrator password?
WORM backups are locked at the storage level for the retention period. Not even an administrator can delete them - and so neither can an attacker with their password.
How quickly can you restore data?
Rolling a volume back from a snapshot takes seconds to minutes, and we can start servers directly from backup. The total company recovery time is defined and verified in the runbook.
Want to see how Guard would protect your business?
We'll review your storage and backups and show where active protection would help.
Contact us