A forwarded port, a router setting or a vendor’s remote-access service can each make a NAS reachable from anywhere, often without anyone deciding it should be. Here is how each one happens, how to check yours in about 15 minutes, and safer ways to reach your files from outside the office.
Viktor (Dante) BurcevskiWildfire Data Recovery · IACIS CFCE 6 November 2026 · 19 min read · 56 references
AI-generated illustration. A NAS that can be reached from the internet is like a storage box left on a public bench, where anyone walking past can get to it. No real device, brand or client is depicted.
If your NAS can be reached from the internet, every new bug in it becomes your problem the day it is published.
That is the uncomfortable lesson of C3RB3R. On 29 October 2026, Synology warned that attackers are exploiting a vulnerability it patched in December 2024 against devices running outdated versions of DSM, and told owners to update immediately and turn on automatic updates. Its statement does not say whether the affected units could be reached from the internet, and it does not mention port forwarding, QuickConnect, UPnP, firewalls or VPNs. [1]
BleepingComputer, reporting on the attacks, goes further and advises blocking access to the management web interface from the internet. That is the publication’s own advice, not Synology’s. It also reports that Shadowserver tracks more than 380,000 internet-exposed Synology NAS units, while noting the figure does not show how many are already secured or are honeypots, decoy systems set up to watch attackers. [2] We could not find a published count for Australia.
This guide covers the part Synology’s statement leaves out: whether your NAS can be reached from outside the office at all. Synology and QNAP get the most detail because both vendors publish their settings, but the same ideas apply to any brand. QNAP menu names here are from QTS 5.2; newer QNAP systems may label them differently.
Three ways in
Any one of them is enough to put a NAS on the internet. Each is explained below, with how to check it.
01 · PORT FORWARDING
A rule on the router
Outside traffic goes straight to the NAS, often because someone set it up for one app. How it happens
02 · UPnP
The NAS asked the router
Router auto-configuration lets the NAS ask the router to open ports for it, which can happen without the owner noticing. [3]How it happens
03 · RELAY
QuickConnect or myQNAPcloud
Vendor relay services can reach the NAS with no ports opened, and on a UPnP router QuickConnect can open ports too. [4]How it happens
Why it matters
Why exposure decides who gets hit.
AI-generated illustration. Attackers sweep the whole internet looking for anything that answers, and an exposed NAS is the box the light lands on.
NAS ransomware is not new, and the vendors’ statements after earlier waves keep returning to the same two things: units that strangers could reach, and units with a missed update or a weak password.
NAS ransomware waves and what the vendor said about internet exposure
Wave
How attackers got in
What the vendor said
2019 · eCh0raix (QNAP)
QNAP said, based on user reports, that infected units were on older QTS versions, or had logged repeated unrecognised sign-in attempts before encryption began.
Update QTS, use a stronger admin password, turn off SSH and Telnet when not in use, and avoid the default ports 443 and 8080. [5]
2019 · Brute force (Synology)
Password guessing from botnet addresses to steal admin accounts. Synology said it was not related to a security vulnerability.
Open public ports only when a service needs them, plus strong passwords, two-step sign-in and auto block. [6]
2021 · Qlocker (QNAP)
A flaw in Hybrid Backup Sync, QNAP’s backup app (CVE-2021-28799). [7]
It targeted unpatched QNAP units directly connected to the internet. QNAP urged owners not to connect the NAS directly to the internet, and suggested myQNAPcloud Link or a VPN on the router instead. [8]
2022 · DeadBolt (QNAP, then ASUSTOR)
NAS units reachable from the internet. On 26 January 2022, Censys data showed 4,988 infected services out of about 130,000 QNAP units that were potential targets. [9]
DeadBolt was widely targeting NAS units exposed to the internet without protection. Remove port forwarding and UPnP, and update QTS. [10]
2022 · Checkmate (QNAP)
Password guessing against SMB file sharing that was exposed to the internet.
Do not expose SMB to the internet; use a VPN instead. Set SMB 2 or later, and review every account’s password. [11]
2026 · C3RB3R (Synology)
A vulnerability patched in December 2024, used against devices running outdated DSM.
Update DSM now and turn on automatic updates. Nothing yet on whether victims were reachable from the internet. [1]
The brand changes from wave to wave. The pattern mostly does not. In our view the internet link is likely for C3RB3R but not confirmed, because Synology has described the outdated software and not how the attackers reach it.
Researchers have tried to count exposed units, but each used a different method, so the numbers cannot be lined up as a trend. In 2021, Unit 42 counted about 240,000 QNAP and 3,500 Synology NAS units connected to the internet. [12] In 2022, Trend Micro counted more than 83,000 internet-exposed QNAP services and more than 2,500 ASUSTOR services. [9] In November 2024, Midnight Blue estimated that one to two million Synology devices were affected by, and exposed to, a flaw in Synology’s photo apps. The estimate came from sampling recently created QuickConnect addresses, and Midnight Blue says the QuickConnect relay also exposes devices with no port forwarding. [13] And BleepingComputer now reports that Shadowserver tracks more than 380,000 exposed Synology units. [2]
The other half of the problem is time. ASD says it has previously seen most vulnerability exploitation happen within two weeks, with some flaws exploited within 48 hours of a patch or advice being released. [14] ASD’s Essential Eight asks organisations to patch the operating systems of internet-facing servers and network devices within 48 hours when the vendor rates a flaw critical or a working exploit exists. [15] ASD does not mention NAS units there. Treating a port-forwarded NAS as an internet-facing server is our reading.
No setting replaces the update. Synology’s advisory for the 2024 flaws, and its September 2026 advisory, which includes two critical flaws that need no login, both list the mitigation as “None”. [16][17] Closing the path from the internet lowers the risk, but only the update removes the flaw. C3RB3R shows how long that window can stay open: Synology says attackers are exploiting a flaw patched in December 2024, almost two years earlier. [1] The advisory that Synology’s statement links to, SA-24:20, shows the DSM 7 fixes were released during November 2024 and the DSM 6.2 fix on 5 December 2024. [16] ASD says it keeps seeing incidents caused by unpatched vulnerabilities, including one first identified in 2008. [18]
Why small businesses should care
ASD names NAS units as common ransomware targets because they often hold important files, and its ransomware guidance tells owners to audit and secure internet-exposed services such as file shares and remote administration. [19] ASD’s ACSC responded to 139 ransomware incidents in 2025-26. The average self-reported cost of cybercrime for a small business was $55,400 per report, across all types of cybercrime, not only ransomware. [18]
Three ways in
Three ways a NAS ends up on the internet.
AI-generated illustration. Port forwarding, UPnP and relay services are three different keys to the same NAS.
Nobody sets out to put the office files on the internet. It can happen because someone wanted one thing to work from outside the office: a photo app on a phone, a camera viewer, or remote access for the person who runs the business. Each setup below does that job, and each one can leave the NAS reachable by strangers as well.
01
Port forwarding
A rule on the router sends outside traffic for a port straight to the NAS. It may have been added by hand, sometimes years ago, for one app. A DMZ host setting does the same for every port at once. [20]
02
Router auto-configuration
The NAS asks the router to open ports for it using UPnP, so no rule is ever typed into the router’s own settings page and the change is easy to miss. [3][21]
03
Relay services
Synology QuickConnect and QNAP’s myQNAPcloud Link connect apps to the NAS through the vendor’s servers, so no port forwarding is needed. On a router with UPnP on, QuickConnect can still add port forwarding rules. [4]
1. Port forwarding: one app, many doors
On a Synology, the DSM web interface, which is the sign-in page for the whole NAS, uses TCP ports 5000 and 5001 by default. They can be changed under Control Panel, Login Portal, DSM. [22] File Station, Synology Photos, Surveillance Station, Download Station and most of Synology’s mobile apps use the same pair. [23] So a rule added to let someone see photos or cameras from a phone also puts the DSM sign-in page on the internet. On a QNAP, the QTS web interface uses port 8080, or 443 for HTTPS. [24]
Synology’s own help can lead owners here. Its DSM 7 QuickConnect page recommends forwarding ports 5000, 5001 and 6690 to improve QuickConnect performance. [25] Its external access guide pairs a Synology DDNS name with port forwarding, so DSM opens at an address such as example123.synology.me:5001. [26] The DDNS name opens nothing by itself. What it adds is an easy-to-remember name pointing at the open port.
2. UPnP: the NAS opens its own doors
In DSM 7, Control Panel, External Access, Router Configuration lets an administrator create port forwarding rules from inside DSM. If the router supports UPnP, DSM’s wizard connects to the router and then writes the rules you pick to the router itself. [27] Synology’s guide shows how short that is: when DSM reports that a UPnP router has been detected, you click Next and Done, then pick the apps to forward. [26] On older units, DSM 6.2’s QuickConnect settings had an option to create port forwarding rules automatically, and Synology’s own note warned it may expose the NAS to security risk. [28] It is not only older units. Synology’s DSM 7.4 specification says QuickConnect “automatically applies required port forwarding rules to compatible UPnP routers”. [4] If a NAS was ever set up that way, look for router rules nobody remembers adding.
QNAP’s equivalent is Auto Router Configuration in myQNAPcloud. QNAP’s QTS 5.2 guide warns that UPnP may expose the device to public networks, and recommends turning it off and setting up any port forwarding by hand on the router. [21] Router makers and government agencies say the same about the router side. TP-Link says malicious apps can abuse UPnP to open ports without the owner knowing. [3] The Canadian Centre for Cyber Security says attackers can use UPnP to bypass firewalls. [29] ASD’s router advice is to turn UPnP off. [30]
3. Relay services: no open ports, still reachable
QuickConnect lets Synology apps connect over the internet without any port forwarding rules. When a direct connection is not possible, its relay service passes the connection through Synology’s relay servers. [25] Typing a QuickConnect address such as QuickConnect.to/example123 into a browser opens the DSM sign-in screen. [26]
That matters. Midnight Blue, the researchers behind the 2024 RISK:STATION flaw in Synology Photos, found that QuickConnect’s relayed route exposed devices that had no port forwarding at all. QuickConnect units get Let’s Encrypt certificates, so their addresses show up in public Certificate Transparency logs, which list millions of QuickConnect subdomains. [13] In other words, a QuickConnect ID is not a secret.
QNAP says its relay, myQNAPcloud Link, gives remote access without exposing the NAS to the internet. [31] Other myQNAPcloud settings deserve a look, though. With Access Control set to Public, anyone can find the device and see its published services. [21] QNAP’s best-practice advice is to untick everything under Published Services and set Access Control to Private or Customized. [32] QNAP says access through myQNAPcloud Link goes through a SmartURL and is limited by Access Control: Private allows only your QNAP ID, and Customized only users you invite. [21][32] We found no independent research on whether myQNAPcloud Link makes the QTS sign-in page reachable, so we are not claiming it does.
Other brands work the same way
Western Digital’s remote access for My Cloud Home lists three connection types: local, direct (which uses port forwarding) and relay, and WD says the router should have UPnP turned on. [33] Separately, in September 2025, WD fixed a flaw in the web interface of its My Cloud NAS range (models such as the PR2100, PR4100, EX2 Ultra and EX4100; Help Net Security does not list My Cloud Home) that a remote attacker could trigger without signing in. The fix is in firmware 5.31.108, according to Help Net Security. [34] TrueNAS recommends keeping its web interface on private networks away from untrusted users, and using a VPN for access across the internet. [35]
Check yours
Check yours in 15 minutes.
AI-generated illustration. Like a quick check-up, a short look at your router and NAS settings can show what is open to the internet.
You need the router’s admin login, an admin account on the NAS and a phone with mobile data. Only check equipment and internet connections you are responsible for. If an IT provider manages your router, ask them to go through it with you.
Six steps to check whether a NAS can be reached from the internet
Step
Where to look
What you are looking for
1. Router port forwarding
The router’s admin page, in the section called Port Forwarding, Virtual Server or NAT. The name varies by brand. [10] Also open the DMZ (or DMZ host) setting. TP-Link describes a DMZ host as a device on the internal network with all TCP and UDP ports open and exposed, except ports forwarded elsewhere; on TP-Link routers it is under Advanced, NAT Forwarding (or Forwarding), DMZ. [20]
Any rule, or a DMZ host setting, that points to the NAS’s local address. Write down each port number.
2. Router UPnP
The router’s UPnP page. TP-Link’s help gives Advanced, NAT Forwarding, UPnP for its routers (its summary box says Advanced, Port Forwarding, UPnP), and More, Advanced, NAT Forwarding, UPnP in the Deco app. [3]
Whether UPnP is on, and whether its table lists the NAS.
3. Synology DSM
Control Panel, External Access: the QuickConnect, DDNS and Router Configuration tabs. [36]
Whether Enable QuickConnect is ticked. Under QuickConnect’s Advanced Settings, whether the relay service is on and which apps use it. [25] Any rules under Router Configuration, and any DDNS name.
4. QNAP QTS
In myQNAPcloud: Auto Router Configuration (behind the icon at the top right in QTS 5.2), Access Control and Published Services. [21][32] Then run QNAP’s security checkup. On QTS 5.2.0 and later, open Security Center, go to Security Checkup and click Scan. Its security policies include “Can the system admin service be accessed from the internet?” and “Is your NAS directly exposed to the internet?” [37] On older QTS, open Security Counselor. [10]
Whether UPnP port forwarding is on, whether Access Control is Public, and any ticked services. In our view, a risk result on either internet-exposure policy in Security Center means the NAS is exposed. [37] QNAP says a Security Counselor dashboard message that “The System Administration service can be directly accessible from an external IP address” means the NAS is exposed. [10]
5. Outside test
Your phone, on mobile data, using the office’s public IP address. Steps below.
Whether a sign-in page or a browser security warning appears from outside the office.
6. Second opinion
Shodan’s InternetDB lookup (free for non-commercial use) for your office’s public IP address. [38] Skip it if your public address is shared (see below).
Ports that Shodan has recorded as open on that address.
The phone test, done safely
Turn Wi-Fi off on your phone so it uses the mobile network. On the office Wi-Fi, this test proves nothing.
Find the office’s public IP address on the router’s status or internet (WAN) page, then compare it with what a “what is my IP” lookup shows from an office computer. QNAP suggests a lookup of this kind for checking whether an address is public. [39] Addresses starting with 10., 192.168. or 172.16 to 172.31 are private, so if the router’s WAN page shows one, it is not your public address. [40] An address from 100.64 to 100.127 usually means your provider uses carrier-grade NAT. [41] If the two addresses differ, something between the router and the internet, such as carrier-grade NAT, is translating the address, and your public address may be shared with other customers. In that case skip the IP address and DDNS parts of this test, the Shodan lookup and any port scan, because they could end up checking someone else’s equipment, and rely on steps 1 to 4.
In the phone’s browser, try http://YOUR-IP:5000 and https://YOUR-IP:5001 for a Synology, or http://YOUR-IP:8080 for a QNAP. On either brand, also try http://YOUR-IP and https://YOUR-IP: Synology uses ports 80 and 443 for Web Station, Synology Drive sharing links and DS photo, and QNAP uses 443 for its HTTPS web interface. [23][24] Also try any other port numbers from step 1, any DDNS name, and your QuickConnect.to address if QuickConnect is on. [26]
If a sign-in page or a browser security warning appears, something on your connection is answering from the internet. Do not sign in and do not click past the warning. If the page shows DSM, QTS or your NAS brand, the NAS is reachable: close the page and move on to the fixes below. If it is your router’s own login page, the router’s remote management is on, which ASD advises turning off. [30]
The phone test is our own procedure, built from the vendors’ port lists. A page that fails to load is not proof you are safe. A relay service may still work, and some internet plans put the connection behind carrier-grade NAT, which can stop port forwarding from working. Aussie Broadband, for example, said in 2024 that it does this for residential services but not for business or static-IP services. [42] These checks cover IPv4 only. If your plan gives the office IPv6 addresses, ask your IT provider to confirm the router’s IPv6 firewall blocks incoming connections to the NAS.
A second opinion from outside
Shodan’s InternetDB shows the open ports Shodan has recorded for an IP address, with no account needed. Add your office’s public IP to the end of its address, as in internetdb.shodan.io/203.0.113.10. It is updated weekly, so if your address changes from time to time, results may belong to whoever had it before. It is free only for non-commercial use, so check Shodan’s terms before using it for a business. [38] It looks only at the IP address, so it will not show relay services such as QuickConnect. QNAP suggests something similar: run an outside port scan of your own public IP, turn off forwarding and UPnP if anything shows as open, then scan again. [39] Only ever check an address that is yours alone.
What the NAS’s own scanner misses
Synology’s Security Advisor checks the NAS’s settings against a home or business baseline. Its help pages do not say it checks for port forwarding or QuickConnect, so a good score is not proof the NAS is off the internet. [43]
What each finding means and what to do about it
What you find
What it means
What to do
Sign-in ports forwarded
Exposed. A rule for 5000 or 5001 (Synology), or 8080 or 443 (QNAP), puts the NAS sign-in page on the internet. A new no-login flaw reaches you the day it is published. [23][24]
Remove the rule today, check the NAS is fully updated, and set up a VPN for remote access.
File-sharing ports forwarded
Exposed. Rules for 139 or 445 (SMB), 21 (FTP), 22 (SSH), 23 (Telnet; 13131 on a QNAP), 548 (AFP), 873 (rsync), 6690 (Synology Drive sync) or 5005 and 5006 (Synology WebDAV; QNAP WebDAV uses 5000 and 5001) put file sharing or admin services on the internet. Checkmate went after exactly this with SMB. [11][23][24]
Remove the rules. Use a VPN for file access.
NAS set as DMZ host
Exposed. Every port not forwarded elsewhere goes to the NAS, so all of its services face the internet. [20]
Turn DMZ off today, then repeat the phone test.
UPnP on
Exposed, or can be at any time. If the NAS appears in the UPnP table, it opened ports itself and can do it again.
Turn UPnP off on the NAS, and on the router once you have checked that nothing else on the network relies on it, then repeat step 1.
QuickConnect on
Reachable through the relay. DSM can be reached through Synology’s servers even with no ports open. [13][26] With UPnP on at the router, it may also have added port forwarding rules, so check step 2. [4]
Turn it off if nobody needs it. If you keep it, keep DSM updating automatically.
myQNAPcloud on Public
Visible. Anyone can find the device and see its published services. [21]
Set Access Control to Private or Customized and untick published services. [32]
A DDNS name
A signpost. It opens nothing on its own, but points straight at any forwarded port.
Remove it if nothing needs it.
Phone test loads
Something answers from the internet. Check whose page it is: the NAS, or the router’s remote management.
Treat a NAS page as urgent: close the path first, then update. If it is the router, turn off its remote management. [30]
Nothing found
Good sign. Not a guarantee.
Check again after any router change, NAS update or new app.
If you find ransom notes or renamed files while checking, stop. Unplug the NAS’s network cable and read the “Already hit?” steps in our C3RB3R guide before changing anything else. If the NAS is not a Synology, use the printable first-hour card in our free NAS ransomware check, which applies to any brand.
Safer access
Safer ways to reach your files.
AI-generated illustration. Keep the NAS sealed inside your own network and reach your files through a VPN instead.
The vendors’ security pages agree on the answer. Synology recommends using a VPN rather than exposing DSM’s management ports, and opening only the ports you actually need. [22] Its ransomware advice says not to expose DSM to the internet unless necessary, and strongly recommends a VPN for file access over the internet. [44] QNAP’s best-practice advice is not to expose the NAS at all, and to connect remotely through myQNAPcloud Link or its QVPN service. [32] The researchers behind RISK:STATION advise allowing only VPN access, with port forwarding and QuickConnect turned off. [13]
ASD’s guidance on edge devices says network management interfaces should not be directly exposed to the internet, because they are not designed to face it, and it counts web admin pages on non-standard ports too. [45] That guidance was written for routers, firewalls and VPN gateways, but the control it quotes (ISM-1863) covers networked management interfaces for IT equipment in general, which we read as including a NAS sign-in page. [45] QNAP suggests avoiding the default ports if you must forward one, [32] but under ASD’s definition a new port number does not make a sign-in page safe to expose.
Vendor setup guides do not always match their security pages. Synology’s QuickConnect help suggests forwarding the DSM ports for performance, [25] and the security section of its external access guide lists auto block, account protection, HTTPS and the firewall without mentioning a VPN. [26] Where the two disagree, follow the security advice.
If you need this kind of remote access, use this instead of exposing the NAS
If you need
Use this
Keep in mind
Remote file access
A VPN on the office router or firewall. Staff join the office network first, and the NAS itself stays off the internet.
ASD treats VPN gateways as edge devices: keep them patched and use phishing-resistant multi-factor authentication (MFA) to sign in. [45]
No VPN on the router
The NAS vendor’s VPN server: Synology VPN Server with OpenVPN on UDP 1194, or QNAP QVPN with WireGuard on UDP 51820. [24][46][47]
One forwarded port replaces many, but it is still an internet-facing service that needs updates. We would choose OpenVPN over PPTP. Synology’s PPTP and L2TP servers sign users in with PAP, which sends passwords unencrypted, or MS-CHAP v2. [46] Microsoft has warned that MS-CHAP v2, when it is the only sign-in method on a PPTP VPN, can expose user credentials. [48] ASD asks for phishing-resistant MFA on VPN sign-ins, [45] and we have not confirmed that Synology VPN Server supports it, so a router or firewall VPN that does may be the better choice.
QNAP phone apps
myQNAPcloud Link, which QNAP says gives remote access without exposing the NAS.
QNAP says it can be slow at peak times and recommends a VPN for better speed and security. [31]
Synology phone apps
The VPN options above. If you keep QuickConnect, turn it on only for the apps you use, in its Advanced Settings. [25]
It still counts as exposure. [13] Synology’s help does not say whether limiting that list stops the DSM sign-in page loading through QuickConnect, so keep DSM updating automatically.
Cameras on a phone
A VPN. Surveillance Station uses the same ports as the DSM sign-in page. [23]
A port forward for the cameras is a port forward for DSM.
IT provider access
The VPN, with the NAS firewall allowing only trusted addresses and denying everything else.
Synology suggests signing in by IP address, not QuickConnect, while you set up firewall rules. [22]
Settings to change today
Turn UPnP off on the router, as ASD advises, after checking that nothing else on the network relies on it. [29][30]
Check router auto-configuration on the NAS too, and remove what you do not need: Router Configuration in DSM, Auto Router Configuration in myQNAPcloud. In QTS 5.2, turning UPnP off closes the ports and services that were opened through it. [21][27]
Turn off relay features nobody uses. In DSM, untick Enable QuickConnect, then repeat steps 1 and 2 to confirm no rules remain. [25] In myQNAPcloud, set Access Control to Private or Customized and untick published services. [32] If nobody uses myQNAPcloud Link, turn it off under myQNAPcloud, myQNAPcloud Link; QNAP notes it cannot be turned off while the device belongs to an organisation. [21]
Turn on automatic security updates. In DSM, go to Control Panel, Update & Restore, Update, click Update Settings and choose Automatically install important updates. [49] In QTS 5.2, go to Control Panel, System, Firmware Update, Firmware Update, Firmware Update Settings and choose Automatically install critical updates. [50]
Turn on automatic updates for apps too. RISK:STATION was in Synology Photos [13] and Qlocker used QNAP’s Hybrid Backup Sync, [7] and Synology’s apps have their own update setting, separate from the DSM one. In DSM, open Package Center, click Settings, go to the Auto-update tab and choose which packages update automatically. Synology notes that some packages do not support it, and that important versions are the ones that fix critical bugs or security vulnerabilities. [51] On a QNAP, look for the matching setting in App Center; we have not confirmed its QTS 5.2 menu path.
Lock down admin access: disable the default admin account once another administrator account exists, turn on two-factor sign-in, auto block and account protection, and set the firewall to allow trusted addresses only, putting the office network’s own address range on that list first so you and your staff are not locked out. [22]
Automatic updates have a limit
Synology’s help says its automatic “latest updates” option “won’t automatically update your Synology NAS to a new major version”. [49] The September 2026 advisory lists fixed builds only for DSM 7.4, 7.3, 7.2.2 and 7.2.1 (7.4-90075, 7.3.2-86009 Update 4, 7.2.2-72806 Update 9 and 7.2.1-69057 Update 12, as DSM shows them under Control Panel, Info Center). It does not mention the original DSM 7.2 release, 7.1 or 6.2 at all, [17] so a NAS on those versions has no fix listed there, and the advisory does not say whether those versions are affected. In our view, a NAS still on one of them should be upgraded by hand if the model supports a newer DSM, or replaced. DSM 7.2.1 and 7.2.2 are not in that group. Until a NAS on DSM 7.2, 7.1 or 6.2 is upgraded or replaced, keep it off the internet, and before any manual upgrade make sure everything on it has a current copy somewhere else. If the fixed build for your version is not offered under Control Panel, Update & Restore, download it from Synology’s Download Center and install it with Manual DSM Update. [49] ASD’s advice is to replace technology before it becomes unsupported and can no longer receive security updates. [52] Our C3RB3R guide lists the safe minimum DSM builds.
Inside the network
Not on the internet is not the same as safe.
AI-generated illustration. A threat already inside the office network can reach a NAS that never touches the internet.
Closing the outside paths removes the easiest attacks. It does not remove the flaw. Midnight Blue noted that with port forwarding off, ports 5000 and 5001 blocked and QuickConnect turned off, a device with the RISK:STATION flaw could no longer be attacked from the internet but was still vulnerable from inside the local network. [13] Anything already inside the office network can still reach the NAS.
That includes the router. At the Pwn2Own hacking contest, the SOHO Smashup category asks researchers to break into a small-office router through its internet-facing port, then move on to a device behind it, with a NAS as one of the allowed targets. [53] In October 2024, two teams went from a QNAP router to a TrueNAS Mini X, one using nine bugs and the other four. [54] In October 2025, another team chained a QNAP router to a QNAP NAS using eight bugs. [55] These were contest results from skilled researchers, not attacks seen in the wild, but they show why the router needs the same care as the NAS.
Real attackers do go after this equipment. A joint advisory from the FBI, NSA and US Cyber National Mission Force, co-sealed by ASD in September 2024, described a botnet that by June 2024 had more than 260,000 hijacked devices, including small-office routers, firewalls and NAS units. It recommends turning off unused services such as UPnP, remote access and file sharing, and replacing end-of-life equipment. [56]
Keep patching anyway
For the recent Synology flaws, the update is the only fix the vendor lists. [16][17] ASD’s ransomware guidance also says to keep NAS devices updated, protect accounts with a strong passphrase or MFA, and consider alerts for high disk activity and sign-ins. [19]
Look after the router
Keep its firmware current, turn off remote management and UPnP, and check its firewall is on. [30] Replace it once the maker stops updating it. [56]
Keep one copy out of reach
During Qlocker, QNAP said the attacker inserted code to delete all snapshots, and it recommended the 3-2-1 backup approach, which usually means three copies of your data, on two different types of storage, with one kept offsite. [8] ASD says the best way to recover from ransomware is to restore from an unaffected backup. [19]
Give backups their own login
Under ASD’s Essential Eight, ordinary user accounts cannot change or delete backups at the first maturity level, and admin accounts, other than backup administrators, cannot at the second. [15] In practice: copy to a second device or cloud account with different credentials, and keep one copy unplugged.
Free tool
Run our free NAS ransomware check.
We have built a free check that covers much of the same ground as this guide. Its version check is for Synology DSM only. It has four parts.
Exposure questions. Port forwarding, UPnP and QuickConnect, in plain language.
Version check. Compares your DSM build with the fixed builds in Synology’s SA-24:20 and SA-26:13 advisories, as at 6 November 2026.
First-hour card. What to do, and what not to touch, if the NAS has already been hit.
Ransom-note decoder. Help making sense of a note if one has already appeared.
Vendor documentation, ASD and the original researchers come first. Security press reports are labelled as such. Where we draw our own conclusion from a source, the text says so. Sources read on 6 November 2026.
BleepingComputer, 2 November 2026, updated 3 November. Shadowserver exposure count. The advice to block the management interface is BleepingComputer’s own.
6 June 2022. Censys counts of DeadBolt-infected QNAP services (January 2022); Trend Micro’s own counts of internet-exposed QNAP and ASUSTOR services (June 2022).
November 2024. One to two million affected and exposed devices, estimated by sampling QuickConnect addresses; exposure through the QuickConnect relay; still vulnerable on the local network; VPN-only advice.
18 September 2026. Two critical flaws that need no login; mitigation listed as none; fixed builds listed only for DSM 7.4, 7.3, 7.2.2 and 7.2.1; DSM 7.2, 7.1 and 6.2 not listed.
Updated 2 October 2026. DSM on 5000 and 5001, shared with Photos, File Station, Surveillance Station and mobile apps; 80 and 443 for Web Station, Drive sharing links and DS photo; Drive sync on 6690; AFP, Telnet, rsync and WebDAV ports.
4 February 2025. ISM-1863 on management interfaces; phishing-resistant MFA, including VPN gateway logins. Written for routers, firewalls and VPN gateways.
19 September 2024. Co-sealed joint advisory. Botnet of over 260,000 devices by June 2024, including routers, firewalls and NAS units; turn off UPnP and unused services; replace end-of-life equipment.
Viktor (Dante) Burcevski
Executive Data Engineer/Owner, Wildfire Data Recovery. IACIS Certified Forensic Computer Examiner (CFCE). Wildfire’s Brisbane laboratory accepts matters from across Australia.
Call us on 1300 806 557. Tell us the make and model and what you found in the checks above, and we will explain what it means in plain language. If the NAS is already showing ransom notes or renamed files, unplug its network cable and leave the drives as they are before you call.
