Synology Ransomware Defense: Isolate Infected Devices

A Synology NAS can become one of the most valuable systems on a business network. It may contain shared documents, application data, Microsoft 365 backups, virtual machine backups, surveillance recordings, and years of business information. That concentration of data also makes protecting the NAS during a ransomware incident extremely important.

Ransomware does not necessarily need to infect DSM itself to damage files stored on a NAS. A compromised workstation with permission to modify a shared folder may encrypt files through SMB or another authorized connection. Stolen administrator credentials can create even greater risk.

Effective ransomware protection for Synology NAS therefore requires more than installing security software. Businesses need a containment strategy capable of quickly isolating infected endpoints, restricting unnecessary NAS access, preserving clean recovery points, and preventing compromised credentials from reaching backup infrastructure.

How Ransomware Can Reach Synology Data

A common misconception is that ransomware must directly compromise the NAS before stored files can be encrypted.

Consider an employee workstation connected to a Synology SMB share.

If ransomware compromises that computer while the user has write access to thousands of shared files, the malware may be able to modify those files using the employee’s legitimate permissions.

Potential attack paths include:

• Compromised Windows workstations
• Stolen user credentials
• Excessive shared-folder permissions
• Compromised administrator accounts
• Exposed remote services
• Vulnerable applications
• Infected servers
• Poorly segmented networks

Protecting the NAS therefore starts with protecting the entire access path to its data.

Isolation Should Be an Immediate Priority

Once ransomware activity is suspected, preventing additional communication can become one of the most important incident-response objectives.

Depending on the environment and incident-response plan, affected devices may need to be disconnected from network resources quickly.

Isolation can involve:

• Disabling a switch port
• Disconnecting Ethernet
• Removing a device from Wi-Fi
• Blocking an endpoint through security tools
• Disabling compromised accounts
• Restricting affected VLAN communication
• Blocking suspicious connections at the firewall

The objective is to prevent the infected device from continuing to reach shared storage and other systems.

Organizations should follow their established incident-response procedures and preserve relevant evidence where investigation is required.

Identify Which Devices Are Actually Affected

An organization should not assume the first computer displaying a ransom note is the only compromised system.

Attackers may have already moved laterally through the network.

IT teams should investigate indicators involving:

• Multiple endpoints
• Servers
• Administrative accounts
• VPN access
• Remote desktop activity
• File servers
• Backup systems
• Synology accounts

Restoring NAS data while compromised systems remain connected can result in recovered files being encrypted again.

Containment should therefore come before broad restoration.

Disable Compromised Credentials

Network isolation alone may not be sufficient if attackers possess valid credentials.

Businesses should identify potentially compromised:

• DSM administrator accounts
• Active Directory accounts
• Backup service accounts
• VPN credentials
• Privileged IT accounts
• Shared service credentials

Credentials should be reset or revoked according to the incident-response plan.

Active sessions and authentication tokens may also require attention depending on the compromised systems and services involved.

Use Least-Privilege NAS Permissions

One of the most effective ways to limit ransomware damage is reducing how much data each account can modify.

Employees should not automatically receive write access to every shared folder.

Permissions can instead follow job responsibilities.

For example:

Accounting users: Accounting folders

Engineering users: Active engineering projects

HR users: Authorized HR resources

Marketing users: Marketing repositories

If a marketing workstation becomes infected, properly segmented permissions can reduce its ability to encrypt accounting or HR information.

Least privilege turns permissions into part of the ransomware containment architecture.

Separate Backup Accounts From User Accounts

Backup infrastructure should not rely unnecessarily on ordinary employee credentials.

If a compromised user account can also administer backups, attackers may be able to damage both production data and recovery copies.

Businesses should use separate identities and privileges for appropriate backup and administrative functions.

Important controls can include:

• Dedicated backup accounts
• Separate administrator accounts
• Strong unique passwords
• Multi-factor authentication
• Restricted management access
• Limited backup permissions

The objective is to prevent one compromised identity from controlling the entire environment.

Network Segmentation Limits Lateral Movement

Flat networks allow devices to communicate more freely than may be necessary.

A stronger business architecture can separate systems according to their roles.

Possible network segments include:

• Employee workstations
• Servers
• NAS storage
• Backup infrastructure
• Surveillance devices
• Guest Wi-Fi
• Management systems

Firewalls or access-control policies can then determine which segments are permitted to communicate.

A compromised workstation should not automatically have unrestricted access to every management interface or backup repository.

Protect DSM Management Access

Synology administrative interfaces deserve stronger protection than ordinary file-sharing access.

Organizations should consider controls such as:

• Multi-factor authentication
• Restricted administrator membership
• Firewall rules
• Secure remote-access architecture
• Automatic blocking where appropriate
• Account protection
• DSM updates
• Application updates

Default or unnecessary exposure should be reviewed.

Businesses should also remove accounts and services that are no longer required.

Snapshots Can Provide Fast Recovery Points

Synology systems using supported Btrfs configurations can use snapshots to preserve point-in-time states of shared data.

If ransomware modifies thousands of files, a clean snapshot from before the incident may provide a faster recovery option than restoring the entire dataset from a conventional backup.

Snapshots can be useful against:

• Mass file encryption
• Accidental deletion
• Unwanted modification
• Administrative mistakes

However, snapshots should be treated as one layer of protection rather than the organization’s only backup.

Protect Snapshots From Attackers

Recovery points are valuable only if they survive the incident.

If an attacker gains sufficient administrative control, accessible recovery mechanisms may also become targets.

Organizations should therefore design snapshot and backup administration with strong privilege separation.

Where supported and appropriate, protected or immutable recovery mechanisms can further reduce the ability to remove recovery points during their retention period.

The goal is to ensure that compromising production systems does not automatically compromise every recovery option.

Maintain an Independent Backup Copy

A Synology NAS containing production data and local snapshots can provide excellent operational recovery, but businesses should still maintain independent copies.

A layered architecture may include:

Layer 1: Production Synology storage

Layer 2: Local snapshots for rapid recovery

Layer 3: Separate backup repository

Layer 4: Offsite or appropriately isolated recovery copy

The exact architecture depends on the organization’s RPO, RTO, budget, and risk profile.

What matters is avoiding one administrative or technical failure domain.

Watch for Mass File Changes

Ransomware frequently produces unusual storage behavior.

Potential warning signs include:

• Thousands of files changing rapidly
• Unexpected filename extensions
• Large numbers of file deletions
• Sudden increases in storage activity
• Unusual authentication attempts
• Unexpected administrative changes

Monitoring NAS activity alongside endpoint, firewall, and identity-security information can help organizations identify suspicious behavior sooner.

Early detection can significantly reduce the number of affected files.

Do Not Immediately Restore Everything

Once ransomware appears contained, organizations may feel pressure to restore all data immediately.

Recovery should be controlled.

Before restoration, determine:

1. How the attacker entered.
2. Which systems were compromised.
3. Which accounts were affected.
4. When malicious activity began.
5. Which recovery point is considered clean.
6. Whether restored systems can reconnect safely.

Restoring from an infected or compromised recovery point can reintroduce the problem.

Test Backups Before an Attack Happens

A backup dashboard showing successful jobs does not prove that business operations can be recovered.

Organizations should routinely test:

• Individual file recovery
• Shared-folder restoration
• VM recovery
• Application recovery
• Offsite backup access
• Recovery credentials
• Actual recovery times

Testing can also reveal whether the organization can meet its documented Recovery Time Objective and Recovery Point Objective.

Preserve Evidence During Serious Incidents

A ransomware incident may require cybersecurity investigation, insurance involvement, regulatory reporting, or legal review.

Administrators should therefore avoid unnecessarily destroying evidence while attempting to restore operations.

Useful evidence may exist in:

• DSM logs
• Authentication records
• Firewall logs
• Endpoint security platforms
• Backup logs
• Network monitoring
• Compromised devices

Organizations may need to preserve affected systems separately while restoring business operations from clean infrastructure.

Build a Synology Ransomware Response Runbook

Businesses should decide how they will respond before ransomware appears.

A practical runbook should document:

1. Who can declare an incident
2. How infected endpoints are isolated
3. Which accounts are disabled
4. How the NAS is protected
5. Who evaluates snapshots and backups
6. How clean recovery points are selected
7. How systems are restored
8. How restored devices are validated
9. When normal network access resumes

Regular tabletop exercises can help ensure employees understand their responsibilities.

Building Stronger Synology Ransomware Protection

Protecting Synology storage from ransomware requires layered security. Endpoint isolation can stop infected devices from continuing to encrypt shared files, least-privilege permissions limit the potential blast radius, network segmentation restricts lateral movement, and protected snapshots and independent backups preserve recovery options.

The strongest strategy combines prevention, detection, containment, backup isolation, and tested recovery rather than relying on any single DSM feature.

Epis Technology helps businesses evaluate Synology environments as part of a wider cybersecurity and disaster recovery strategy, including network segmentation, backup architecture, access controls, ransomware resilience, and recovery planning.

About Epis Technology

Epis Technology helps organizations secure, configure, and protect Synology NAS environments against ransomware and other business disruptions. Services include Synology security assessments, cybersecurity consulting, network segmentation, DSM hardening, snapshot and backup architecture, offsite protection, ransomware recovery planning, disaster recovery testing, and ongoing Synology support. Epis Technology helps businesses build layered protection that can isolate compromised systems quickly, preserve trustworthy recovery copies, and restore critical data securely after an incident.