Ransomware Attacks Target End-of-Life Synology NAS Devices
Ransomware Targets Synology NAS Devices Running Obsolete Software
Full Report
Executive Summary
The Hong Kong Computer Emergency Response Team Coordination Centre (HKCERT) has issued an alert on November 2, 2026, warning of an active wave of ransomware attacks targeting Synology Network-Attached Storage (NAS) devices. The attackers are exploiting a known vulnerability, patched by Synology in December 2024, to gain access and encrypt data on the devices. The campaign is specifically successful against devices running older, end-of-life (EOL) versions of Synology's operating system, DiskStation Manager (DSM). These EOL versions no longer receive security updates, leaving them perpetually vulnerable. HKCERT and Synology strongly advise all users to upgrade to a supported DSM version, avoid exposing their NAS management interface to the internet, and maintain offline backups.
Threat Overview
Threat: Active ransomware campaign.
Target: Synology NAS devices.
Attack Vector: Exploitation of a known vulnerability patched in December 2024.
Vulnerable Systems: Devices running end-of-life (EOL) versions of DiskStation Manager (DSM).
Impact: Data is encrypted, and a ransom is demanded for decryption (T1486 - Data Encrypted for Impact).
This campaign highlights the significant and often-overlooked risk of running hardware and software past its support lifecycle. Threat actors systematically scan for and exploit legacy vulnerabilities on EOL devices because they represent an easy and guaranteed entry point into a network.
Technical Analysis
The threat actors are not using a zero-day vulnerability. Instead, they are weaponizing a known flaw that has had a patch available for nearly two years. The attack chain is straightforward:
- Scanning (
T1595 - Active Scanning): Attackers continuously scan the internet for exposed Synology NAS login portals. - Vulnerability Identification: They identify devices running outdated, EOL versions of DSM by fingerprinting the software version.
- Exploitation (
T1190 - Exploit Public-Facing Application): The attackers use a public or private exploit for the 2024 vulnerability to gain unauthorized access to the device, likely with administrative privileges. - Payload Deployment: Once on the system, they deploy the ransomware payload, which traverses the file system and encrypts user and business data.
- Ransom Note: A ransom note is dropped, instructing the victim on how to pay for a decryption key.
Synology also recently patched the "PHP2Shell" vulnerabilities, though a direct link to this specific ransomware campaign has not been confirmed. This indicates that NAS devices are frequently targeted via flaws in both the core OS and its third-party components.
Impact Assessment
For small businesses and home users who rely on NAS devices for centralized storage and backup, a ransomware attack can be devastating. The impact includes:
- Permanent Data Loss: If no offline backups exist, the encrypted data may be lost forever, as paying the ransom does not guarantee a working decryption key.
- Business Disruption: Critical business operations that rely on data stored on the NAS will come to a halt.
- Financial Loss: The cost includes the ransom demand (if paid), recovery efforts, and potential replacement of hardware.
This incident underscores that even if a device is physically functional, it becomes an unacceptable security risk once it stops receiving security updates.
IOCs — Directly from Articles
No specific Indicators of Compromise (e.g., IP addresses, file hashes) were mentioned in the source articles.
Detection & Response
- Log Monitoring: Review Synology DSM logs for unauthorized login attempts or access from unfamiliar IP addresses.
- Network Monitoring: Monitor for unusual outbound traffic from the NAS device, which could indicate communication with a command-and-control server.
- File Integrity Monitoring: If enabled, file integrity monitoring can alert on the rapid, widespread modification of files characteristic of a ransomware attack.
If a device is compromised, immediately disconnect it from the network to prevent the ransomware from spreading. Restore data from a known-good offline or immutable backup.
Mitigation
- Upgrade or Replace: This is the most critical mitigation. Users must upgrade their DSM to the latest supported version. If the hardware is too old to support a modern version of DSM, the device must be decommissioned and replaced.
D3-SU: Software Updateis the primary defense. - Disable Internet Exposure: Never expose the Synology DSM management interface directly to the internet. Access should be restricted to the local network. If remote access is required, use a secure VPN connection to the network first. This aligns with
M1035 - Limit Access to Resource Over Network. - Maintain Offline Backups (3-2-1 Rule): Keep at least three copies of your data, on two different media, with at least one copy stored offline or in an immutable cloud storage repository. This ensures that even if the NAS is fully encrypted, you can restore your data.
- Disable Unnecessary Services: Disable any services and applications on the NAS that are not actively used to reduce the device's attack surface.
Timeline of Events
MITRE ATT&CK Mitigations
Update Software
Upgrade DSM to a supported version. If the hardware is too old, it must be replaced to receive security updates.
Do not expose the NAS management interface to the internet. Use a VPN for remote access.
Maintain regular, offline backups of critical data so it can be restored without paying a ransom.
Disable unused services and applications on the NAS to reduce its attack surface.
D3FEND Defensive Countermeasures
The most critical defense is to eliminate the root cause of the vulnerability: the end-of-life software. All owners of Synology NAS devices must immediately check their DiskStation Manager (DSM) version. If it is an EOL version, they must upgrade to a supported release. If the hardware does not support a modern version of DSM, the device is an unacceptable risk and must be replaced. This incident is a textbook example of why asset management and end-of-life tracking are crucial security functions. Running unpatched, unsupported software on an internet-facing device is an open invitation for attack, as threat actors systematically exploit such low-hanging fruit.
Never expose a NAS device's management interface (e.g., DSM on ports 5000/5001) directly to the public internet. This single action mitigates the vast majority of automated, opportunistic attacks. Configure firewall rules to block all inbound connections to the NAS from the internet. If remote access is necessary, it should be achieved by first connecting to the local network via a secure, full-tunnel VPN. This places the NAS behind a defensible perimeter and ensures that only authenticated and authorized users can reach its login page. This defense is effective even if the device is unpatched, as it prevents attackers from reaching the vulnerable service in the first place.
Assume that a breach is always possible and prepare for recovery. Implement a robust backup strategy following the 3-2-1 rule: three copies of your data, on two different types of media, with at least one copy stored offline or in an immutable storage location. For Synology devices, this can be achieved using Hyper Backup to back up data to a separate, air-gapped USB drive, another offsite NAS, or a cloud storage provider that supports immutable buckets (like AWS S3 Object Lock). An immutable backup cannot be altered or deleted by ransomware, ensuring that you can always restore your data without paying a ransom. This is the ultimate safety net against a destructive attack.
Timeline of Events
Synology releases a patch for the vulnerability now being exploited.
HKCERT issues an alert about the active ransomware campaign targeting EOL Synology devices.
Sources & References
Article Author
Jason Gomes
• Cybersecurity PractitionerCybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
Editorial Standards & Analyst Review
CyberNetSec.io uses automation to assist source monitoring, deduplication, observable extraction, and structured intelligence generation. Published analysis follows human-defined editorial standards and adds defensive context including MITRE ATT&CK, D3FEND, STIX, and Sigma where applicable. Read our editorial policy.
Tags
📢 Share This Article
Help others stay informed about cybersecurity threats
🎯 MITRE ATT&CK Mapped
Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.
🧠 Enriched & Analyzed
Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.
🛡️ Actionable Guidance
Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.
🔗 STIX Visualizer
Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.
⚡ Sigma Generator
Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.