Your Home NAS Is a Ransomware Target. Here's the Hardening Checklist

Most of us treat a NAS like a quiet closet: plug it in, forget about it, and assume "local" means "safe." Attackers see it differently — one always-on box holding years of photos, documents, and backups is one of the highest-value targets in a home network.

The attack path is boringly predictable:

1. Find an exposed service — the DSM admin panel, SSH, or SMB reachable from the internet.
2. Guess or steal credentials — default passwords and credential stuffing do most of the work.
3. Encrypt everything reachable — modern ransomware hunts snapshots and attached backup drives before touching primary data.

Here's the checklist that actually changes your odds.

Close the front door

• Disable SMBv1 entirely — it has no reason to exist in 2026.
• Never expose SSH or the DSM admin panel to the WAN. Reach them through a VPN (WireGuard or Tailscale) instead.
• Turn on the built-in firewall and allow-list only the addresses you need.

Make a stolen password useless

• Enable MFA everywhere it's offered: DSM login, Drive, Photos.
• Use a separate non-admin account for daily access; keep the admin account out of browsers and everyday apps.
• Store its password in a manager — never reused anywhere else.

Segment the box

• Put the NAS on its own VLAN if your router supports it, so an infected laptop can't walk straight into storage.

Back up like the attacker is already inside

• Follow 3-2-1: three copies, two media types, one offsite and offline.
• Snapshots are fast but still connected — add an immutable copy the attacker cannot reach.
• Test a real restore quarterly. A backup you've never restored is a hope, not a plan.

Patch and audit

• Set DSM and package updates to install automatically.
• Once a quarter, list running services and disable anything you don't actively use.

I went deeper on this — attack vectors, what to do in the first hour when something looks wrong, and a full recovery runbook — in the guide over at hSECURITIES: https://hsecurities.in/blog/ransomware-alert-synology-nas-attacks

This post was drafted with AI assistance.