Synology NAS ransomware prevention: rebuild, hardening, and backups

Close the intrusion entry point first

Recovering data does not mean the original system is trustworthy. Once the business is usable again, rebuild the system in a clean environment, replace related credentials, and install the fixed version for your model based on Synology's official security advisories and release notes.

This site does not currently list specific CVE numbers or DSM version numbers, to avoid misleading information across different models and release channels. Check the Synology security advisories and your device's actual update notes directly.

Reduce public exposure

• Check the port mappings, firewalls, and remote-access settings for IPv4 and IPv6 on your router, and close the entries you do not need.
• Check management channels such as QuickConnect, reverse proxies, DDNS, and external SSH, and keep only the ones that are necessary and restricted.
• Check for abnormal scheduled tasks, startup items, accounts, and login records. Do not batch-delete based on file names alone; confirm the source and impact first.
• Before restoring services, confirm that sync tasks will not spread ciphertext or abnormal configuration to other devices.

Build real backups

Follow the 3-2-1 principle: keep at least three copies of your data on two types of media, with one copy in a different location. The most important copy should be offline, immutable, or strictly write-protected, so that the ransomware cannot destroy online backups at the same time.

Snapshots are one recovery method, but they are not a complete backup. A snapshot on the same device that the same account can delete cannot replace an independent copy.

Run recovery drills regularly, and verify backups with complete digests, file format checks, or actual application recovery. A "backup succeeded" message alone does not mean the data is usable.

Sources: main rescue repository rebuild recommendations after recovery (Chinese), Synology security advisories.