If you are curious how the tunnel works you can look at the following post linked below. I dove into that mechanism 9 years ago.
That may be why I was spared. I had remote access enabled, but I specified my own ports manually (which Orion will register) and did not use the relay mechanism. Anyone trying to access my My Book Live drive would have had to not only scan my IP address, but pick the correct port to connect to. Though Orion does do that mapping, so someone could have scanned all the wd2go domains. It’s possible that’s broken though. I don’t think WD owns the wd2go domain anymore though.
I just connected my WD directly to my MAC via an USB-C to Ethernet adapter and checked and didn’t find any sign of hacking. No crontab, no virus files, no changed files, etc. Considering I have UPNP enabled on my router (though not on the WD drive itself) and I had remote access enabled, I don’t know how I wasn’t hit by this. I guess I was just lucky.
