Devices and platforms: NAS, routers, firewalls and hypervisors

Updated November 2026

Appliances often run Linux or BSD underneath, sit at the edge of the network and are forgotten until they are attacked. Ransomware gangs and botnets target NAS boxes, routers and hypervisors because they hold valuable data and are rarely updated.

Three rules for every device

Never expose its admin interface to the internet; use a VPN.
Turn on automatic firmware or security updates where the vendor offers them.
Replace devices that no longer receive updates.

Why devices get attacked

Botnets and ransomware groups scan the whole internet for login pages of NAS boxes, routers and hypervisors. One unpatched flaw in such a device can give an attacker every file on the network, or a foothold inside it. Many devices also stop receiving updates long before they stop working, so checking the vendor's support status matters as much as installing updates.

A simple routine

Write down every device: model, firmware version and whether the vendor still supports it.
Turn on automatic or notified updates, and subscribe to the vendor's security advisories.
Reach admin pages only through a VPN, never through port forwarding or "cloud access" you do not need.
Use unique admin passwords and two-factor login where offered; remove default accounts.
Keep backups or snapshots that the device itself cannot delete, so ransomware cannot destroy them.
Replace devices that have reached end of life.

Guides for each platform

MikroTik RouterOS is covered in its own guide.