Taiwan Information Security Association
Join TWISA
Menu

Exploitation reportedThu, 29 Oct 2026

Ransomware targeting older Synology DSM: check the NAS before updating

An exposed NAS can put backup and recovery at risk. First determine whether the device shows signs of encryption or compromise.

Download PDF (Traditional Chinese)View applicable solutionsBack to Security alerts
01

Article

On October 29, 2026, Synology warned of ransomware attacks on outdated DSM, pointing to flaws patched in December 2024 and advisory SA-24:20. It did not identify a CVE for this campaign. Separately, 360 attributed the entry paths in the C3RB3R samples it handled to CVE-2026-13639 and CVE-2026-13684 in SA-26:13. The two reports cover different observations and do not establish a single attack path for every affected device.

Synology rates both SA-26:13 CVEs 9.8 under CVSS v3.1. It describes login logic and SCGI flaws affecting remote file access or service availability. Check both advisories for your model and DSM branch. For example, the minimum fixed build for DSM 7.2.2 is 7.2.2-72806-1 in SA-24:20 and 7.2.2-72806-9 in SA-26:13. Apply the latest supported security update for your model.

Attack flowHow the attack reaches the service
  1. 01

    Reach a vulnerable NAS

    A management path to an older DSM build can expose the device.

  2. 02

    Gain access to files

    The observed entry path depends on the incident and the device’s configuration.

  3. 03

    Disrupt recovery

    If the same credentials can modify backups, ransomware can affect both production data and recovery copies.

What to do: from the perimeter to internal systems

Response flowResponse steps
  1. 01

    Find exposed devices

    Inventory NAS devices, versions, remote access, administrators and connected backups.

    See what to doResources: 1

    TWISA member solutions

    Find exposed devices

    Inventory NAS devices, versions, remote access, administrators and connected backups.

  2. 02

    Update and limit exposure

    If there are no signs of compromise, restrict management access and apply vendor updates by model and branch.

    See what to doResources: 1

    TWISA member solutions

    Update and limit exposure

    If there are no signs of compromise, restrict management access and apply vendor updates by model and branch.

  3. 03

    Isolate and preserve evidence

    If files are encrypted or compromise is suspected, involve responders and isolate the device. Preserve evidence before deciding when to restart, update or rebuild.

    See what to doResources: 1

    TWISA member solutions

    Isolate and preserve evidence

    If files are encrypted or compromise is suspected, involve responders and isolate the device. Preserve evidence before deciding when to restart, update or rebuild.

  4. 04

    Recover from a trusted copy

    Check backups with independent credentials and verify restoration. A DSM update does not decrypt files.

    See what to doResources: 1

    TWISA member solutions

    Recover from a trusted copy

    Check backups with independent credentials and verify restoration. A DSM update does not decrypt files.

Defense architectureLayered defense

NAS management, identity and backup boundaries

Allow authorized traffic and apply controls at each layer.

  1. 01

    Find exposed devices

    NAS management, identity and backup boundaries

    Validate the controlInventory NAS devices, versions, remote access, administrators and connected backups.

  2. 02

    Update and limit exposure

    NAS management, identity and backup boundaries

    Validate the controlIf there are no signs of compromise, restrict management access and apply vendor updates by model and branch.

  3. 03

    Isolate and preserve evidence

    NAS management, identity and backup boundaries

    Validate the controlIf files are encrypted or compromise is suspected, involve responders and isolate the device. Preserve evidence before deciding when to restart, update or rebuild.

Feed logs and traffic data from each layer into monitoring and response.

  1. Recover from a trusted copyCheck backups with independent credentials and verify restoration. A DSM update does not decrypt files.

Test and verify

Use authorized asset discovery, vulnerability scanning, penetration and API testing, and attack simulation. Retest after changes and verify monitoring against actual system behavior. Verify that production accounts cannot rewrite independent recovery copies.

TWISA member solutions

Sources and further reading

Alert updated: 2026/10/29. Check the vendor’s latest guidance for product support and patch status.