Synology NAS Ransomware Alert
What Malaysian Businesses Need to Know
Synology has confirmed ransomware attacks targeting devices running outdated DSM software. Learn about the security risks, available updates and practical steps to protect your organisation's critical business data.
Synology Confirms Ransomware Attacks Against Outdated DSM Systems
Organisations using Synology NAS should review their firmware, security configurations and backup readiness.
On 29 October 2026, Synology issued an official cybersecurity announcement confirming that threat actors were exploiting a previously patched security vulnerability affecting outdated versions of DiskStation Manager (DSM).
According to Synology, the attackers aim to encrypt stored data and demand ransom payments from victims.
For Malaysian businesses relying on Synology NAS for shared documents, file storage, backup operations and other critical information, the announcement highlights the importance of keeping systems updated and properly secured.
However, the announcement does not mean that every Synology NAS device has been compromised. Actual exposure depends on the installed DSM version, enabled services, network configuration and other security factors.
Important Security Notice: Synology confirmed that attackers are exploiting a vulnerability patched in December 2024. The company strongly recommends that users running vulnerable DSM versions install the applicable security updates immediately.
Why Should Businesses Be Concerned?
NAS storage can support many important business operations. A security incident affecting these systems may disrupt access to essential data.
File Encryption
Ransomware can encrypt stored files and prevent authorised users from accessing important business information.
Operational Disruption
Loss of access to shared files or backup infrastructure may interrupt daily business processes.
Backup Exposure
If the NAS is also used as a primary backup destination, an incident may affect the organisation's ability to recover data.
Key Synology Security Developments in 2026
Several important security advisories were issued before the latest ransomware warning. These are related security concerns, but they should not be treated as one identical vulnerability.
Critical DSM Vulnerabilities
Synology published advisory SA-26:13 addressing multiple DSM security vulnerabilities, including issues that could allow remote attackers to access or modify files.
CyberSecurity Malaysia Advisory
CyberSecurity Malaysia published an advisory highlighting multiple DSM vulnerabilities and recommending the necessary security updates.
PHP2Shell Security Advisory
Synology disclosed critical vulnerabilities affecting certain PHP versions and related applications. Customers using affected packages should review the relevant updates.
Active Ransomware Warning
Synology confirmed ransomware activity exploiting a vulnerability patched in December 2024 against outdated DSM systems.
DSM Security Updates Businesses Should Review
The following minimum fixed releases relate specifically to Synology Security Advisory SA-26:13, published on 18 September 2026.
DSM 7.4
DSM 7.3
DSM 7.2.2
DSM 7.2.1
Six Steps to Strengthen Your Synology NAS Security
Businesses should adopt a layered approach to NAS security, combining software updates, controlled access and reliable backup protection.
Update DSM Firmware
Check DSM under Control Panel > Update & Restore. Install applicable security updates and plan an appropriate maintenance window for business-critical systems.
Review Internet Exposure
Check remote access, router port forwarding, firewall rules and exposed administration services. Avoid unnecessary public access to DSM management interfaces.
Strengthen Administrator Security
Review administrator privileges, remove unnecessary accounts, use strong unique passwords and enable multi-factor authentication where supported.
Update Installed Packages
Open Package Center and review available updates. Pay particular attention to affected PHP versions and applications referenced in Synology's official advisories.
Verify Independent Backups
Maintain separate backup copies, preferably including offline or immutable recovery points. Regularly verify backup integrity and test restoration procedures.
Monitor Suspicious Activity
Review system logs, unfamiliar user accounts, failed login attempts and unexpected file changes. Investigate suspicious activities promptly.
Important Reminder: RAID Is Not a Backup
Storage redundancy and data recovery protection serve different purposes.
Why Independent Backups Matter
RAID configurations can help maintain storage availability when certain hardware failures occur. However, RAID does not prevent ransomware from encrypting files stored on the NAS.
If both production files and backup copies remain accessible to an attacker, they may be affected during the same incident.
Businesses should consider a layered backup strategy that includes separate recovery copies and regular restoration testing.
What If Your Synology NAS Is Already Compromised?
If ransomware infection is suspected, avoid treating the incident as a routine firmware maintenance task.
Contain the Affected System
Follow your incident-response procedure and isolate affected systems from unnecessary network access where appropriate.
Notify Your IT Administrator
Inform the responsible technical personnel immediately. Avoid making unplanned changes that could complicate investigation.
Preserve Relevant Evidence
Retain available system logs, suspicious files, ransom notes and incident details for technical investigation.
Assess the Extent of Compromise
Determine which accounts, shared folders, services and backup copies may have been affected.
Plan a Controlled Recovery
Recover from verified clean backups only after the underlying compromise has been investigated and appropriately contained.
Strengthening Business Storage & Cybersecurity
Protecting critical business data requires more than installing firmware updates. Organisations should periodically review their overall infrastructure and recovery readiness.
NAS Security Review
Review firmware versions, access controls, network exposure and security configurations to identify potential risks.
Backup & Disaster Recovery
Review backup arrangements, recovery objectives and available data protection solutions for business continuity.
Managed IT Services
Support ongoing IT infrastructure maintenance, security reviews and technical support based on business requirements.
Synology NAS Security: Common Questions
Does this mean every Synology NAS has been hacked?
No. Synology confirmed attacks targeting vulnerable, outdated DSM installations. Whether an individual NAS is exposed or compromised requires a separate technical assessment.
Is updating DSM sufficient to secure my NAS?
Firmware updates are essential, but they are only one layer of security. Businesses should also review installed packages, administrator accounts, network exposure, MFA and backup protection.
Can ransomware affect a NAS using RAID?
Yes. RAID provides storage redundancy, not protection against malicious encryption. Separate recoverable backups are still necessary.
Should businesses disable NAS remote access?
Unnecessary internet-facing services should be disabled. Where remote access is required, organisations should use appropriately secured access methods and review firewall configurations.
What should I do if my NAS is running an older DSM version?
Check your device model and supported software updates through Synology's official resources. For unsupported systems, evaluate available mitigations and a migration plan to supported infrastructure.
Is Your Business NAS Secure and Your Data Recoverable?
Ark IT Global helps Malaysian SMEs and corporate organisations review IT infrastructure, network security, data protection and recovery readiness. Contact our team to discuss your organisation's cybersecurity requirements.
Request a Cybersecurity Assessment →Security Advisories & Further Reading
For the most accurate and current technical information, refer to Synology's official security advisories and recognised cybersecurity authorities.
Disclaimer: This article is published by Ark IT Global Sdn Bhd for general cybersecurity awareness and educational purposes. Ark IT Global is not affiliated with Synology Inc. The information reflects publicly available security announcements as of 30 October 2026. Individual device exposure, vulnerability status and remediation requirements depend on the specific hardware, firmware, software packages and security configuration. For technical remediation, refer to the latest official manufacturer guidance and consult qualified IT security personnel.