Your Synology NAS Can Be Encrypted Without Anyone Logging In

Synology says ransomware crews are exploiting a NAS flaw it patched in December 2024, encrypting shared files and the backups stored beside them. The fix is a DSM update and a NAS the internet can't reach.

I write these with help from an AI assistant and check the facts against the sources linked in the piece.

Picture the office manager at a small accounting firm. Her morning starts the way it always does, with the shared drive. It lives on a Synology NAS in the supply closet, the same box that holds the firm's backups.

Nothing looked wrong the night before. Nobody on staff opened a strange attachment or clicked a link. The antivirus on every PC stayed quiet, and the lights on the NAS kept blinking the way they always do.

Then she opens a client folder. Every file name now ends in .L0CK3D. A text file called read-me3.txt sits in each folder, offering to unlock one file as a test and pointing to a payment page on Tor, a hidden network you reach with a special browser. She opens the backup folder, and the files there carry the same ending and the same note.

The attacker never typed a password. They came in through a hole in the NAS's own software that Synology fixed in December 2024. This box never got the update.

What just happened

On October 29, Synology warned customers that attackers are "exploiting a vulnerability patched in December 2024" to break into NAS boxes running outdated software, encrypt the data, and demand a ransom. A NAS (network-attached storage) is a small computer full of hard drives that holds an office's shared folders. Synology's runs its own operating system, DSM (DiskStation Manager), and that's where the holes are.

Synology points to advisory SA-24:20, which covers flaws first shown at the Pwn2Own 2024 hacking contest. The worst of them, tracked as CVE-2024–10441, lets a remote attacker run code on the box, and Synology rates it as needing no login. 360, a Chinese security company, traces the cases it investigated to two newer flaws instead, CVE-2026–13639 and CVE-2026–13684. Synology fixed those on September 18 in SA-26:13. Both let an outsider read or write any file on the NAS without signing in. IT-Connect reports that 360 has been getting calls for help from Synology owners since early October. Synology hasn't said which flaw was used where.

Once inside, the attackers run C3RB3R, a variant of the older Cerber ransomware. According to Gridinsoft's summary of 360's findings, it encrypts each file with its own key, renames it with the .L0CK3D ending, and leaves read-me3.txt in the folders it hits.

Think of the NAS login page as a front desk. These flaws let a stranger skip the sign-in sheet and hand the receptionist instructions she follows anyway. Anyone who can reach that desk from the internet can try it on your box.

Why your NAS password didn't help

The antivirus on your office PCs never gets a look. Nothing in this attack runs on a PC. The ransomware is planted on the NAS and encrypts your files from there.

The NAS password and two-step login don't come into it either. Synology rates all three flaws as needing no login and no help from anyone on your staff. A stronger password guards a door the attacker isn't using.

RAID doesn't save you. RAID spreads your files across several drives so one dead drive doesn't lose them, and it copies the encryption to every drive just as faithfully. As IT-Connect notes, "A NAS, even with RAID storage, is not a backup." The backup folder on the same box gets encrypted with everything else. An earlier piece in this series covers why one copy has to live off that network.

Your router's firewall keeps outsiders out until someone tells it not to. A port forward, a router rule that sends outside traffic to one device inside, is exactly that instruction, and it can point straight at the NAS. QuickConnect, Synology's remote access feature, lets apps reach the NAS over the internet with no port forward at all. Either one makes the NAS reachable from the internet.

The update is the protection that works. Synology lists no workaround for the September flaws, so installing the fixed version is the only way to close them. It won't unlock files that are already encrypted, which is why it has to happen first.

What you can do this week

1. Update DSM and let it keep itself updated Free, about 20 minutes plus a restart. Go to Control Panel > Update & Restore > DSM Update and install what's offered. The September fixes start at 7.4–90075, 7.3.2–86009–4, 7.2.2–72806–9 or 7.2.1–69057–12, depending on your version line, and the advisory lists nothing older. Then click Update Settings and choose "Automatically install important updates that fixed critical security issues and bugs (Recommended)," which is the setting Synology itself recommends. A box still on DSM 6.2 stopped getting regular security updates when that version reached the end of its Extended Life Phase on October 1, 2024, so start pricing its replacement.
2. Take the NAS off the open internet Free, about 15 minutes. On your router, delete any port forward that points at the NAS (usually ports 5000 and 5001) unless someone can tell you exactly why it's there. DSM's own port forwarding rules live in Control Panel, under External Access > Router Configuration. If nobody reaches the NAS from outside the office, open Control Panel, go to External Access > QuickConnect, and untick Enable QuickConnect. Anyone who needs files from home should come in over a VPN, an encrypted tunnel into the office network, instead of through an open login page.
3. Update the apps on the NAS and remove the ones nobody uses Free, about 15 minutes. On October 22, Synology shipped a separate critical fix for PHP, the software behind packages (Synology's word for NAS apps) such as Calendar, Mail Station, Web Station and WordPress; nothing ties those flaws to the ransomware campaign, but they also need no login. Open Package Center and update PHP first, as Synology advises, then update Mail Station by hand, since it needs its own manual update. Uninstall every package nobody on staff can name a use for, and turn on automatic package updates in Package Center's settings.

The harder truth

Synology hasn't said how many boxes were hit. What I can count is the leak sites, the public pages where crews list the businesses they claim to have breached so the pressure to pay goes up. This week I counted 107 victims posted by 27 crews. The total barely moved from last week, but the mix changed.

Of the seven healthcare victims, two were dental groups, and third-party estimates put five of the seven under $25 million a year in revenue. One crew listed a single-location family doctor's office in Germany. Others posted a plating shop in Arkansas and a personal injury firm in Minnesota. Schools went from 3 to 11 in a week, six of them from one crew, Interlock. These are the crews' claims, posted on their own leak sites.

Each of these businesses holds other people's records: patient charts, families' payment details, a customer's specs and purchase orders, an injury client's medical files.

Dental practices have now turned up on leak sites in four of my last five issues, posted by at least four different crews.

If this was useful

S6 Ransomware Signal is my weekly look at ransomware for small and mid-size businesses without a dedicated security team. I'm an Army combat veteran. I founded S6 Tech, a veteran-owned managed IT provider, and I've spent about 15 years in managed IT.

Two more things from this week. Supermarket freezers in Sweden, Belgium, Ireland, Estonia, the Netherlands and Luxembourg were remotely set to 50°C on November 2, and The Record reports that Danfoss and Copeland say the controllers hit in the earlier French wave were mainly discontinued products that no longer got security updates. Huntress traced a handful of break-ins in September and October to camera management software on Windows PCs, where attackers opened a remote shell (a hidden command line they control) and hid their code behind a genuine Microsoft parental controls program.

I covered the French wave of those freezer attacks in an earlier piece.

If you want next week's piece, follow me here on Medium. The menu on the Follow button can send each new story to your inbox.