TL;DR:

  • QNAP and Synology NAS devices are actively targeted by ransomware gangs — eCh0raix and DeadBolt encrypted tens of thousands of devices in earlier campaigns; CISA has issued warnings about ongoing exploitation
  • The biggest risk factor is having your NAS directly exposed to the internet — QuickConnect and direct port forwarding both create attack surface
  • Critical configuration steps: disable QuickConnect or use it behind 2FA, enable auto-updates, disable the default admin account, restrict SMB access to the local network
  • Ransomware recovery from NAS-only backup that was also encrypted is effectively impossible — immutable off-site backup is not optional
  • Business impact is severe: recovery from a NAS ransomware incident averages £40,000–£50,000 for a small business once you account for downtime, data recovery, and IT costs

The Synology DS series on a shelf in the back office looks like a solved problem. Affordable, reliable, easy to set up. Shared folders for the whole team, automatic backup from everyone’s laptops, remote access from home. It works so well that it becomes invisible — which is exactly when it becomes a liability.

Network-attached storage devices are among the most reliably targeted assets in small business networks. Not because they are particularly vulnerable by design, but because businesses routinely expose them to the internet with weak passwords and outdated firmware, then back up to them and assume that is sufficient protection against data loss. When ransomware encrypts that NAS, both the primary data and the backup are gone simultaneously.

What Ransomware Gangs Are Actually Doing

The eCh0raix ransomware variant, first observed in 2019, has been updated multiple times and continues to target QNAP and Synology devices in 2026. DeadBolt, which targeted QNAP devices in 2022, infected over 20,000 units in its peak campaigns by exploiting a known vulnerability in devices that had not received firmware updates.

The attack pattern is consistent: automated scanning finds NAS devices with admin interfaces exposed to the internet, tests for known vulnerabilities or default credentials, gains access, and encrypts file shares. The ransom demand typically appears as a modified login page on the device itself.

CISA has issued formal warnings about NAS devices being used as ransomware staging points — attackers sometimes use compromised NAS storage as pivot points into the broader network, not just as ransomware targets.

Synology devices have had fewer high-profile incidents than QNAP, partly because Synology’s firmware update delivery is more reliable and partly because the QuickConnect remote access service is better architected than QNAP’s equivalent. Neither should be considered safe without configuration hardening.

The Most Common Exposure Points

QuickConnect and direct internet exposure: QuickConnect is Synology’s cloud relay service for remote access. It works without port forwarding and does not directly expose your device to the internet — traffic routes through Synology’s servers. That is meaningfully safer than forwarding port 5000 or 443 directly to your NAS, which puts your admin interface on the public internet. Many businesses do the latter for convenience, and this is the single most common cause of NAS ransomware incidents.

Unpatched firmware: Both QNAP and Synology release firmware updates to patch known vulnerabilities. Devices that have not been updated in months are typically running with publicly known exploits available. This is trivial to check: the DSM or QTS interface shows available updates on the dashboard.

Default or weak admin passwords: Some older QNAP devices shipped with default credentials. Synology prompts for password creation during setup but does not enforce complexity requirements for subsequent changes. Weak admin passwords are easily brute-forced once a device is found.

SMB exposed to the internet: SMB file sharing should never be accessible from the internet. It exists for LAN access. Yet businesses with misconfigured firewalls or routers sometimes inadvertently expose SMB shares, which attackers can access directly.

Configuration Steps That Actually Reduce Risk

Disable QuickConnect or restrict it behind VPN. If remote access to your NAS is not a business requirement, disable QuickConnect entirely. If it is, restrict access to accounts that have two-factor authentication enabled and monitor login logs for unexpected access attempts.

Enable automatic firmware updates. Both Synology DSM and QNAP QTS have auto-update settings. Enable them for security patches at minimum. A firmware update during a working day is less disruptive than a ransomware incident.

Disable the built-in admin account. Create a named admin account with a strong password, then disable the default “admin” account. This eliminates the most common brute-force target.

Set firewall rules to block SMB from outside the LAN. On both Synology and QNAP, the firewall configuration should deny all inbound connections to SMB ports (445, 139) from outside your local network range.

Enable IP block for failed login attempts. DSM’s Security Advisor and QNAP’s Security Counselor both include this. After three to five failed login attempts from an IP address, block it automatically. This prevents brute-force attacks from being practical.

Set up a read-only account for automated backup access. If another service is backing up to or from the NAS, use a dedicated account with minimum necessary permissions rather than the main admin credentials.

The Backup Problem

The critical issue with NAS ransomware is that businesses often use their NAS as their backup destination. When the NAS is encrypted, the backup is encrypted with it. Recovery then depends on whatever the NAS vendor’s snapshot capability managed to preserve — if snapshots were enabled before the attack, some recovery is possible. If not, the data may be unrecoverable without paying the ransom.

The only reliable protection is a backup that the ransomware cannot reach:

  • Immutable cloud backup: Services like Backblaze B2, Wasabi, or Amazon S3 with Object Lock create versions that cannot be deleted or modified for a set period. Even if your NAS account credentials are compromised, the attacker cannot delete or encrypt existing backup versions.
  • Offline or air-gapped backup: A removable drive or tape backup that is physically disconnected when not in use cannot be encrypted remotely.
  • 3-2-1 rule: Three copies of data, on two different media types, with one copy off-site. The on-site NAS backup counts as one copy, not the primary protection strategy.

Synology’s C2 Backup service integrates directly with DSM and creates encrypted cloud backups with version history. For small businesses already using Synology, this is the lowest-friction path to off-site immutable backup.

UK small businesses that handle personal data under UK GDPR also have an obligation to protect that data from loss or unauthorised access. A NAS ransomware incident that destroys customer or employee records may require notification to the ICO. Appropriate technical security measures — which includes proper backup and access controls — are not optional under the regulation.

Getting the NAS configuration right takes less than two hours. The alternative is a recovery process that takes weeks and costs tens of thousands of pounds.