NAS Guides · Published 2026-11-02

Check Point's Yoba Report: Who Vets Your Backup Software

Direct answer up front, then the trade-offs that matter. This page covers check point and answers: how to check points on license.

Quick Answer

Check Point Research's 27 October 2026 report describes a campaign it tracks as Yoba: fake GitHub projects posing as AI desktop apps — GPT-5.6 Sol, GPT-6 Astra, Claude Opus — that ship a malicious winmm.dll next to a genuine, digitally signed OpenAI or Anthropic Setup.exe. The signature is real. The folder around it is not. If you let an app upload phone photos to a NAS on a schedule, that detail should bother you, because the thing you approved was never a single signed file. It was a directory of files, and only one of them earned the badge. That should change how you inspect yours.

Key Takeaways

• Check Point Research tracked the campaign from roughly July 2026 to the end of August, using fake GitHub projects for AI desktop apps that do not exist (accessed 2026-11-02).
• The installers paired a signed OpenAI or Anthropic Setup.exe with a malicious winmm.dll, which Windows loads from the application folder before it looks in system32 (Microsoft Learn, accessed 2026-11-02).
• Persistence ran through a copied Windows Media Player binary and a scheduled task; tasking arrived inside Google DNS-over-HTTPS records; the observed payload was an XMRig miner.
• For phone-to-NAS backup, the write mode matters more than the hardware. One-way versioned upload survives an event that two-way sync spreads.
• Btrfs snapshots with an immutable retention window give you a rollback point. A snapshot on the same volume is not a backup.

What Changed

The loading trick is not new. Windows resolves a DLL from the folder the executable launched from before it looks in system32, so a properly signed launcher can still pull an unsigned payload sitting beside it. Microsoft's own documentation spells this out in the search order — application folder at step 7, system folder at step 8 — and adds a warning that an attacker who controls any searched directory can drop a malicious copy there (accessed 2026-11-02).

Check Point's write-up (accessed 2026-11-02) puts the dropper behind a lock that requires it to be started by Setup.exe, then parks it in a delay loop of roughly 200,000 iterations before doing anything. Anti-analysis code from another era, still paying rent.

Delivery was the modern half. None of the three repositories carried bought stars or forks. They ranked near the top of Google anyway, which the researchers attribute to SEO poisoning: titles, descriptions and github.io pages tuned for what people type when they want a free desktop client for a model they have read about. Three repositories, three throwaway Outlook addresses, three different timezones.

Timing shows patience. The first repository went up in July 2026; the first malicious release landed at the end of August, six weeks later. Persistence ran through a copied Windows Media Player binary and a scheduled task. Command and control skipped dedicated servers: an image from a Telegram channel seeded a domain-generation algorithm, tasking came back inside Google's DNS-over-HTTPS TXT records, and Catbox and Tor handled the rest. The payload Check Point observed was XMRig, a Monero miner.

A miner is the polite outcome. The same loader could have dropped a wiper, and nothing in the delivery chain would have needed to change.

One thing the report does not settle: whether this loader has carried anything beyond a miner. It says the chain can deliver other PE files or PowerShell scripts and leaves it there. Treat that as unconfirmed rather than reassuring.

Mirage Security's summary of the same research (accessed 2026-11-02) draws the conclusion I would draw. A digital signature is one signal about one file, not a verdict on the installer package.

What a Signature Signs

Code signing answers a narrow question. Who built this binary, and has it changed since? It says nothing about the six other files in the ZIP, the scheduled task the installer created, or the folder the whole thing unpacked into.

That is the gap.

Signing is a receipt, not a warranty.

That matters more for storage gear than it sounds. A home NAS backup chain is a stack of third-party code: a phone app, a desktop sync client, a container image, a scheduled script that calls rsync. Each one is a directory of binaries from somewhere. Most owners audit none of them.

Here is the honest position. I cannot tell you that any specific NAS vendor's sync client is clean, and neither can a review published last year. What you can check is where the binary came from and who signed it.

Real-World Scenario: Automatic Lossless Photo Backup for Mobile

What this changes for the use case

Automatic upload is a promise about write behaviour, not about storage capacity. Two implementations share the name and behave nothing alike.

The first mirrors. Phone and NAS hold the same tree, and a delete on either side propagates. It is convenient, and it is the mode that turns one infected laptop into an empty photo library: the deletion or the encryption reaches your NAS as a normal write, and your phone confirms it without being asked.

The second archives. Every upload lands as a new versioned object, nothing on your NAS is deleted by the phone, and you do not mount that share read-write from anything else. Slower to set up. Boring to look at. It is also the mode that survives the week you get hit.

Set the job up so your phone can create files on the NAS but never delete them. That one permission choice matters more than the app you pick. When your phone uploads into a share it can only write to, a bad week on the phone costs you nothing. When it uploads into a share it can delete from, one sync conflict or one factory reset can take your originals with it, and you will not notice until you go looking for a photo that used to be there. Most apps call this backup and ship the two-way mode as the default anyway, because two-way feels tidier when you delete a screenshot and want it gone from the box as well. Tidiness is not what you are buying.

The Yoba report does not change any of this. It sharpens the question. Your photos travel through code you installed, and that code is the trust boundary — not the NAS chassis, not the drive model, not the RAID level.

Hardware and software requirements

Snapshot support is the part worth paying for. On Synology hardware that means Btrfs plus Snapshot Replication: point-in-time copies of shared folders and LUNs, minute-level scheduling, snapshots that finish in seconds, and an immutable mode with a mandatory protection period (Synology, accessed 2026-11-02). Grandfather-Father-Son retention keeps your hourly copies from eating the volume, and you can pull a single file back through File Station or Windows File Explorer without asking an admin.

Budget the space before you budget the bays. A policy that keeps 24 hourly, 7 daily and 4 weekly copies needs headroom on the same volume. Your photo library changes slowly, so the delta stays small. Your video library does not behave that way.

On the phone side, the requirements are dull: the vendor's own app from the official store, background upload permission, and a rule that only that app writes to the destination share. If you also mount that share read-write from a laptop, you have rebuilt the mirror problem with extra steps and a wider attack surface. That is the arrangement that turns one bad installer on one machine into a folder of unreadable files on the box you bought to protect them.

Limits, caveats, and who should skip it

A snapshot on the same volume is not a backup. It shares the disks, the controller, the power supply and the admin account. Ransomware that reaches your NAS with admin rights can delete the snapshots too. The immutable mode with a protection period is the mitigation, and it is the setting you will leave off unless you go looking, because the default retention template does not switch it on.

Skip this arrangement if you want nothing to maintain. Phone-to-NAS backup needs the app running, the box powered, and you reading the task log once a month. That is less work than a subscription and it is not zero.

Skip it too if your library is small. A 200 GB iCloud+ plan was $2.99 a month in Apple's US price list on 2026-10-02, which is hard to beat on effort for a phone-only library under that ceiling. Our guide to backing up a large phone library without paying covers where that ceiling bites.

Who Vets Your Backup Software

Four checks, all boring, all cheap. Do them once and you stop guessing.

Start at the vendor's own site. Navigate to the download from a page you typed yourself, not from a search result, and do not treat a GitHub release as a stand-in for a vendor page. The Yoba repositories looked plausible. They ranked well. Neither fact tells you who built the installer.

Then look at what the installer writes. If your sync client drops a scheduled task pointing at a binary in %ProgramData%, you have found something the marketing page left out. Watch out for this one specifically: a task that runs with high privileges and calls a file the installer created has the same shape as the persistence in the Check Point report, and it is the check you will skip because the app works fine afterwards.

Pin what you can pin. A container image referenced by digest cannot be swapped under you the way a latest tag can, and a NAS you configured six months ago is easier to reason about when the image you approved is still the image running.

Separate the accounts. Your NAS admin login should not be the credential your desktop browser saves, and the share holding the archive should not be writable by the machine you browse the web on. If you only do one of these four, do this one.

If you have a Windows machine in the house, spend one evening on its scheduled tasks. You are looking for entries that call a binary in a user-writable directory, that run whether you are logged in or not, and that nobody in the household remembers creating. You will find a dozen harmless updaters and, once in a while, something you did not install. Delete what you cannot explain, then check whether the same installer touched your NAS share. Most of these jobs run as the logged-in user, so what they can reach is exactly what you can reach.

Our take: twenty minutes now against finding out during a restore. Worth it if you already run scheduled backups and have never asked who wrote the uploader. Skip it if the box is a hobby machine holding nothing you would miss.

How It Compares

The table below comes from our specification ledger, not from a spec sheet I retyped. Both units run Btrfs, which is the prerequisite for the snapshot advice above.

_Sources: Synology official comparison (DS225+) · Synology official comparison (DS925+)_

_Legend: an em dash means our ledger holds no verified reading for that field, and we do not substitute a sibling model's number. Struck-through values are expired readings only._

Pick on the rows you will actually hit. If you plan to keep snapshots and a container or two beside the photo share, the DS925+ ceiling of 32 GB is the number that matters, against 6 GB on the DS225+; you will notice the smaller figure the first time a snapshot purge and a photo index rebuild overlap. Bays and M.2 slots decide what you can add later, not what works today.

Two rows decide it for snapshot work. The DS925+ lists 2 GB of installed RAM against 4 GB on the smaller box, and 32 GB of headroom against 6 GB — the difference between running a few containers beside the snapshot service and not. The DS225+ also shows no NVMe slot, which rules out a read cache later. Neither price is current; both readings are from 2026-10-02 and should be treated as historical, not quoted as today's number.

Frequently Asked Questions

Does a signed installer prove the software is safe?

No. A signature binds a binary to a publisher and detects later modification of that binary. It says nothing about other files shipped in the same archive, which is exactly the gap the Yoba campaign used: a valid OpenAI or Anthropic executable loading a winmm.dll from its own folder. Check the publisher of every executable and DLL in the directory, not just the one you double-clicked.

Is automatic phone backup to a NAS safer than iCloud?

It is safer against vendor-side account problems and pricing changes, and it is not automatically safer against malware. The risk moves to you: instead of trusting one cloud provider, you are trusting the app, the share permissions and your own admin habits. One-way versioned upload plus immutable snapshots covers more failure modes than two-way sync. Neither replaces a second copy off the box.

Do snapshots protect photos from ransomware?

Partly. You can restore a snapshot taken before the encryption, and the immutable mode with a protection period blocks deletion during that window (Synology, accessed 2026-11-02). A snapshot on the same volume shares the disks and the admin account, so it fails when both fail. Keep one copy on hardware you had not mounted when the encryption ran.

How much does this setup cost?

A two-bay DS225+ was listed at $364.99 diskless on Amazon and a four-bay DS925+ at $749.76, both checked 2026-10-02 and both now a month old. Drives are extra, and you will spend more on them than on the DS225+ itself: a WD Red Plus 8 TB sat at $431 on a DatacenterDisk listing and a Seagate IronWolf 8 TB at $347 on Amazon, same date. We could not verify current pricing for any of the four.

What exactly did Check Point find?

A campaign active since around July 2026 that used fake GitHub repositories and github.io pages to distribute installers for apps that do not exist, with a signed executable included to make the package look legitimate. The observed payload was a Monero miner. Check Point says the loader can carry other payloads; it did not document any.

Sources

• Check Point Research, campaign report on Yoba, signed-binary abuse and the Telegram/DoH command channel: https://research.checkpoint.com/2026/tricks-from-the-past-deployed-via-signed-chatgpt-and-claude-binaries/ (accessed 2026-11-02)
• Mirage Security, attack summary naming winmm.dll and the XMRig payload: https://www.miragesecurity.ai/attacks/article/fake-ai-apps-on-github-deliver-yoba-malware-a4f0f4af (accessed 2026-11-02)
• Microsoft Learn, Dynamic-link library search order, application folder before system folder: https://learn.microsoft.com/en-us/windows/win32/dlls/dynamic-link-library-search-order (accessed 2026-11-02)
• Synology, Snapshot Replication feature page, Btrfs snapshots, immutable mode and GFS retention: https://www.synology.com/en-global/dsm/feature/snapshot_replication (accessed 2026-11-02)
• Synology, DS225+ and DS925+ official comparison pages, quoted in the specification table above (accessed 2026-11-02)
• Apple Support, iCloud+ plan pricing, US store: https://support.apple.com/en-us/108047 (accessed 2026-11-02)

Affiliate Disclosure: SecureNAS Hub may earn a commission from qualifying purchases made through links on this page, at no extra cost to you. Facts and figures are attributed in the Sources list; nothing on this page is a fabricated test result. See our full disclosure. Product images are either supplied by the manufacturer or clearly labelled as illustrative renders; each one is captioned accordingly. Last reviewed 2026-11-02.