Ransomware Alert – Ransomware Attacks Targeting Synology NAS Devices

Release Date:
2 Nov 2026

724
Views

Security Alert

Description

A recent wave of ransomware attacks has targeted Synology Network-Attached Storage (NAS) users, encrypting stored data and demanding ransom. According to Synology, the attacks exploit a vulnerability patched in December 2024 and target devices running end-of-life versions of DiskStation Manager (DSM). Users running affected DSM versions should update immediately.

Separately, Synology has released security updates addressing PHP2Shell vulnerabilities affecting systems running certain PHP-dependent packages. The vendor has not confirmed whether PHP2Shell was involved in the ransomware attacks. Users should follow the vendor’s guidance to update DSM and install applicable security updates for PHP and related packages.

Preventive and Remediation Measures

 

HKCERT recommends that users and system administrators:

• Update DSM immediately:Upgrade to the latest applicable DSM version that is supported by both the device and the vendor. Users running end-of-life versions should plan an upgrade. If the device cannot run a supported version, consider replacing it. For affected versions and patch details, please refer to  Synology urges users to apply security updates, extends PHP2Shell fixes to older DSM releases
• Update PHP and affected packages: Install the PHP security updates through Package Center. Updates are available for DSM 7.4, 7.3, 7.2, 7.1, 7.0 and 6.2. Dependent packages restart automatically after the PHP update. MailStation requires a separate manual update through Package Center. These fixes do not mean that end-of-life DSM versions have returned to full support. For detailed instructions, please refer to Synology Extends PHP2Shell Security Updates to End-of-Life DSM Versions
• Address older systems: For systems running DSM versions earlier than 6.2, temporarily disable the affected packages as recommended by the vendor, then upgrade to a supported DSM version.
• Reduce network exposure: Avoid exposing NAS management interfaces directly to the internet. Disable unnecessary services and port forwarding, and restrict remote access.
• Protect important data: Maintain offline or immutable backups and regularly test restoration procedures.

Actions for Suspected Infection

If files are unexpectedly encrypted or ransom notes appear, HKCERT recommends:

1. Isolate the affected device immediately:Disconnect the NAS from the network and suspend connected synchronisation and backup jobs to help prevent other data or backups from being affected.
2. Preserve evidence: Retain ransom notes, encrypted file samples, system logs and access logs, and record when the suspicious activity was discovered. Avoid resetting, formatting or unnecessarily restarting the device.
3. Seek incident response assistance: Contact IT support or an incident response service provider to investigate the entry point and determine the scope of the compromise.
4. Restore services only after remediation: Remove malware and unauthorised access, install security updates, and reset potentially compromised credentials from a clean device. Restore data from verified clean backups only after the environment has been secured.
5. Do not rely on ransom payment for recovery: Paying the ransom does not guarantee data recovery. Installing security updates will not decrypt files already encrypted by ransomware.

Businesses or members of the public who wish to report to HKCERT on information security related incidents such as malware, phishing, denial of service attacks, etc. can do so by completing the online form at: https://www.hkcert.org/incident-reporting, or calling the 24-hour hotline at +852 8105 6060. For further enquiries, please contact HKCERT at [email protected].

Reference：

• Synology urges users to apply security updates, extends PHP2Shell fixes to older DSM releases
• Synology Extends PHP2Shell Security Updates to End-of-Life DSM Versions