Pompeyexile I will get this sorted if it chuffin kills me!
Might be a bit late for you, and you may have already seen it, but I think this video might describe the exact attack that happened on your Qnap (you are not alone to suffer from it), explains how it happened and tells how you can reduce the chances of it happening again:
If I understand correctly, the attack came via a vulnerability in the service that makes it easy for users to connect to their NAS over the internet (MyQNAPcloud on QNAP, and QuickConnect on Synology). It is very easy do disable this service, but it will make accessing the NAS less convenient.
The alternative that the video suggests is putting the NAS on a VPN, and then using the VPN to log onto it. I am familiar with this route, because I use VPN’s at work when I need to log onto services on clients’ networks (It has now became standard that all corporations require the use of VPN to access their services for security). Indeed it is less convenient to have to do that for a NAS.
It is always going to be a trade-off between security and convenience. Personally I think I will not stop using QuickConnect. Instead I will make sure that I have a backup of the important files off the NAS, and also use the other security measures that are not that inconvenient (reasonable passwords, firewall, update the OS and apps etc.). I hope mine won’t be broken into, and if it will happen - I will deal with it by recovering from my backup.