Synology Investigates Ongoing Brute-Force Attacks From Botnet
What Synology’s investigation into botnet-driven brute-force attacks means for businesses and how Epis Technology can help
Synology has confirmed that there has been an increase in large-scale brute-force login attempts on Synology NAS devices all over the world. Synology’s Product Security Incident Response Team (PSIRT) says that a botnet connected to a type of malware called StealthWorker is behind these attacks. The campaign uses devices that have already been hacked to systematically guess weak or commonly used administrative passwords on NAS systems that are open to the public.
Synology has said that there is currently no proof that an underlying software flaw is being used. Instead, attackers are mostly getting in where basic security measures are missing, like weak passwords, open management ports, or the lack of multi-factor authentication. Once they have access, attackers can use the compromised NAS to launch attacks on other Linux-based systems or install malicious software, such as ransomware.
This incident shows that NAS platforms are no longer just passive storage devices, which is something that is becoming more and more true for businesses. They are important parts of infrastructure that need to be protected, watched, and managed with the same care as servers, firewalls, and cloud workloads.
Understanding the Threat Landscape
Brute-force attacks that use botnets are very automated and last a long time. Synology PSIRT saw that infected devices work together to spread login attempts across many IP addresses. This makes traditional rate-limiting and perimeter defenses less effective, unless they are set up correctly.
If a hacker is able to get into a NAS system that an organization uses for file sharing, backups, surveillance, or SaaS protection, they could:
- Ransomware encrypts backups and important data
- Getting credentials and moving sideways into other systems
- Data theft and exposure to rules
- Service outages and longer recovery times
These risks are even worse when NAS devices are connected to the internet without strong access controls.
Synology’s Suggested Fixes
Synology has told administrators to check their systems right away and put in place important security measures:
- Check and improve all administrative credentials
- Turn on features that automatically block IPs and protect accounts
- Make sure that multi-step or multi-factor authentication is used
- Check system logs for strange login patterns
- If you see any strange activity, get in touch with Synology support
These steps work, but many businesses have trouble using them consistently on multiple devices, in different places, and by different users, especially as their environments grow.
Where Epis Technology Comes In
Epis Technology is very important here. Epis Technology is an expert at protecting, setting up, and running Synology-based environments for businesses that can’t afford to lose data, have downtime, or have security holes.
Epis Technology doesn’t see brute-force defense as a one-time setup job. Instead, they see NAS security as an ongoing operational discipline.
Epis Technology helps businesses in a number of important ways, such as:
- Secure Synology deployment: Making NAS systems more secure from the start by dividing the network, setting up firewall rules, limiting services, and designing secure remote access.
- Strategy for credentials and access control: use least-privilege access, require MFA, and connect NAS access to larger identity and policy frameworks.
- Backup isolation and ransomware resilience: Creating backup systems that can’t be encrypted or deleted by even a hacked admin account.
- Centralized monitoring and alerting: Making sure that brute-force attacks, lockouts, and strange access patterns are found right away, not days later.
Being ready for an incident means helping businesses set up clear steps for stopping, rotating credentials, and recovering if they find suspicious activity.
Recovery is just as important as prevention
One of the worst things people think about NAS security is that blocking access is enough. Modern ransomware groups think that defenses will eventually fail, so they focus on destroying backups to stop recovery.
Epis Technology helps businesses make sure that their Synology environments can really recover by:
- Regularly testing restores from backups and snapshots
- Checking to make sure that backup credentials are not linked to user accounts
- Making sure that compromised systems can’t change backups that are stored offsite or in the cloud
- Making sure that backup retention meets business and compliance needs
This focus on being able to recover, not just preventing, is what makes a security incident a manageable IT event instead of a business-ending crisis.
A Call to Action for NAS Security
The StealthWorker botnet activity teaches us an important lesson: attacks that use brute force don’t need zero-day exploits to work. All they need is one weak password, one service that is open to the public, or one device that isn’t being watched.
Synology’s quick investigation and advice give you a strong technical base, but to keep your data safe in the long term, you need to set it up correctly, keep an eye on it all the time, and have tested recovery plans.
Epis Technology fills the gap between vendor recommendations and real-world operational security for businesses that rely on Synology NAS for important data. This helps make sure that storage platforms stay strong, safe, and recoverable even as automated threats keep changing.