Your NAS Is a Ransomware Target: How to Protect Your Synology or QNAP Box

The Box in the Closet Is a Computer Too

In most of the small and mid-sized offices we visit across Cleveland, Akron, Canton, and Youngstown, there's a small box on a shelf. It might be a Synology or a QNAP. It holds the shared drive, the scanned documents, the project folders, and very often the nightly backups. Everyone depends on it, and almost nobody thinks about it.

That's exactly why attackers love it.

Synology has been urging customers to update their network-attached storage (NAS) devices after ransomware attacks hit units running outdated software. The attacks exploited a vulnerability Synology had already patched back in 2024. That means the devices that got hit weren't victims of some brand-new, unstoppable technique. They were running software that was missing a fix that had been available for a long time.

We aren't going to guess at CVE numbers or affected model lists here. Synology publishes that information on its official Product Security Advisory page, and that's the source you or your IT partner should check against your own device. What we want to focus on is the bigger lesson, because it applies to every NAS in every office, Synology or not.

This Isn't the First Time NAS Devices Have Been Targeted

Ransomware crews have gone after network storage for years. A few well-documented examples:

• eCh0raix ransomware targeted QNAP devices, and later variants were reported going after Synology units as well.
• Qlocker (2021) and DeadBolt (2022) hit large numbers of internet-exposed QNAP devices, encrypting files directly on the box. QNAP tracks its fixes on its Security Advisories page.
• Synology has previously warned customers about botnet-driven brute-force login campaigns aimed at its devices.

The pattern is consistent. Attackers scan the internet for storage devices, look for ones running old software or weak logins, and break in at scale. They aren't hunting for your business specifically. They're hunting for any box that answers the door.

Why a NAS Is Such an Attractive Target

1. The Backup Trap

This is the part that keeps us up at night on behalf of our clients.

In a lot of small businesses, the NAS does double duty. It stores the shared files the team uses every day, and it stores the backups of those files (plus backups of PCs, servers, or accounting data). It feels efficient. One device, one place, everything covered.

But think about what happens when ransomware encrypts that box. The attacker doesn't just lock up your working files. They lock up the copies you were counting on to recover. The data and the way to get the data back disappear in the same moment.

For a law or accounting firm, that could mean client files and years of records. For a healthcare practice, it can mean patient-related documents and a potential HIPAA headache on top of the operational one. For a manufacturer, it could be CAD drawings, CNC programs, and production records that keep the floor running.

A backup that lives on the same device it's protecting isn't really a backup. It's a second copy waiting to be encrypted alongside the first.

2. The "It's Just Storage" Mindset

Most people treat a NAS like a filing cabinet or an external hard drive. Plug it in, map the drives, forget about it.

But a modern NAS is a full computer. It runs an operating system (DSM on Synology, QTS or QuTS hero on QNAP). It runs a web server for its admin page. It often runs apps for photo sharing, media streaming, file syncing, remote access, and more. Every one of those components is software, and software has bugs that get discovered and patched over time.

Nobody would leave a Windows server unpatched for a year or two and expect it to stay safe. Yet that's exactly the situation with many NAS boxes, simply because nobody thinks of them as computers. When a fix is released and the device never receives it, the box stays vulnerable indefinitely, and attackers have plenty of time to build tools around the known flaw.

3. Exposure to the Open Internet

A NAS sitting quietly on your internal network is a much harder target than one reachable from anywhere in the world. Unfortunately, it's easy to put a NAS on the open internet without realizing it. Common ways it happens:

• Remote access features. Synology's QuickConnect and QNAP's myQNAPcloud make it convenient to reach files from home or on the road. Convenience is great, but these features extend the reach of the device beyond your office, and they need to be configured and kept current with care.
• Port forwarding. Someone (maybe a previous vendor, maybe a helpful employee) opened ports on the router so the NAS admin page or file services could be reached from outside.
• UPnP (Universal Plug and Play). Many routers and NAS devices support UPnP, which lets devices open ports on the router automatically. That means the box can expose itself without anyone ever deciding it should.
• Unused services left on. FTP, SSH, Telnet, old file-sharing protocols, and add-on apps that were tried once and never removed all add more ways in.

Combine an internet-facing NAS with outdated firmware, and you have exactly the kind of device ransomware crews scan for.

The Fix: What We Recommend for Every NAS

The good news is that protecting a NAS isn't complicated. It's mostly discipline: keep it current, keep it hidden, lock down the logins, and never let it be your only copy.

Update the Firmware Now, and Keep It Updated

• Log in to the NAS and check for DSM (Synology) or QTS/QuTS hero (QNAP) updates. Install the latest version supported by your model.
• Update every installed package or app as well, not just the core operating system.
• Turn on update notifications so you know when new fixes arrive. Many devices also allow automatic installation of important security updates.
• Check whether your model is still supported. Older units eventually stop receiving security fixes. If yours has reached end of life, plan a replacement rather than hoping for the best.

Take the NAS Off the Open Web

• Review your router and firewall for any port forwarding rules pointing at the NAS, and remove the ones you don't absolutely need.
• Disable UPnP on both the router and the NAS.
• For remote access, use a properly configured VPN or another secure remote access method rather than exposing the NAS login page directly to the internet.
• If you use QuickConnect or myQNAPcloud, decide deliberately whether you truly need it, and if you do, keep it tightly configured and patched.

Lock Down Accounts and Services

• Disable the default admin account and use a uniquely named administrator account instead.
• Turn on multi-factor authentication (MFA) for administrator accounts, and ideally for all users.
• Use strong, unique passwords and enable auto-block or account lockout for repeated failed logins.
• Turn off services you don't use (FTP, Telnet, SSH, unused apps and packages).
• Give users access only to the shared folders they actually need.

Never Let the NAS Be Your Only Copy

This is the step that turns a ransomware attack from a catastrophe into an inconvenience.

Follow the 3-2-1 backup rule, which CISA describes in its data backup guidance: keep three copies of your data, on two different types of media, with one copy stored offsite. We'd add two more requirements for today's threat landscape:

• At least one copy should be offline or immutable, meaning ransomware on your network can't reach it, change it, or delete it. Snapshot features on the NAS can help, but they shouldn't be your only protection, since an attacker with admin access may be able to remove them.
• Backups must be verified and tested. A backup job that reports "success" isn't the same as a backup you've actually restored from. CISA's #StopRansomware guide specifically recommends maintaining offline, encrypted backups and regularly testing them.

When you test a restore, time it. Knowing that it takes hours (or days) to bring back your shared drive is valuable information to have before a crisis, not during one.

Your NAS Security Checklist for This Week

Print this out, hand it to whoever manages your office technology, and work through it:

1. Identify every NAS in your office (including the old one in the back closet that "isn't really used anymore").
2. Check the firmware version against the vendor's security advisory page and install all available updates.
3. Update all installed apps and packages on the device.
4. Turn on update notifications (and automatic security updates where appropriate).
5. Confirm the model is still supported. If it isn't, schedule a replacement.
6. Review router and firewall rules for port forwards to the NAS. Remove anything unnecessary.
7. Disable UPnP on the router and the NAS.
8. Move remote access behind a VPN or another secure method.
9. Disable the default admin account and enable MFA for administrators.
10. Turn off unused services like FTP, Telnet, and SSH.
11. Confirm you have a backup copy that does not live on the NAS, ideally offsite and offline or immutable.
12. Do a test restore of a real folder and confirm the files open correctly.

If you can't check every box confidently, that's a sign it's time to bring in help.

How LNS Protects the Storage Your Business Depends On

At Local Network Solutions, we look at a NAS the way an attacker does: as a computer on your network that holds your most valuable data. That's why we don't treat storage, networking, and backups as separate problems handled by separate vendors. Our approach ties them together:

• Backup & Disaster Recovery: We build backups that don't depend on a single device, with daily backup verification, rapid recovery, tested recovery playbooks, and comprehensive disaster recovery planning. If your NAS is ever compromised, your recovery path is already somewhere else.
• Network Infrastructure: We design firewall rules and network architecture so storage devices aren't sitting exposed on the open internet, and we give you visibility into what's reachable from outside.
• 24/7 Monitoring: Our team watches for anomalies around the clock, so unusual activity gets attention before it turns into encrypted files and a ransom note.

Because all six of our IT pillars sit under one roof and one SLA, there's no gap between "the backup company" and "the network company" for something like an exposed NAS to slip through.

We're an independent, locally owned Northeast Ohio company, and we've spent more than 10 years protecting 500+ businesses across the region, from professional services firms and healthcare practices to manufacturers and colleges. We've seen hardware failures, power outages, and ransomware up close, and we know prevention beats recovery every single time.

Don't Let Your File Server Become Your Weakest Link

The ransomware hitting outdated NAS devices isn't exploiting anything exotic. It's exploiting the gap between when a fix is released and when it actually gets installed, plus the habit of storing backups on the same box as the data they protect. Both gaps are entirely closable.

If you're not sure whether your Synology or QNAP is current, exposed, or carrying your only backups, let's find out together. Schedule Your Consultation with our team today. Email us at [email protected] or call (216) 658-6988. We'll help you close the gaps, so your files and your recovery plan stay yours.

Complete IT Infrastructure. Zero Gaps. Zero Excuses.