Urgent advisory: Ransomware exploiting underlying software flaws ("PHP2Shell") to seize control and lock Synology storage devices

1 | Incident summary

RSM Hong Kong is tracking automated ransomware attacks targeting internet-exposed Synology NAS devices. Attackers exploit underlying web-software vulnerabilities, including the reported “PHP2Shell” flaw, to bypass authentication and gain administrative control.

Cerber (C3RB3R) ransomware operators scan for exposed devices, disable security controls, encrypt corporate files and delete local backups before demanding payment—disrupting operations and compromising recovery.

2 | Risk exposure and business impact

For SMEs and branch offices, NAS devices often hold both shared files and backups. Key risks include:

Device takeover Attackers exploit web-software flaws to bypass authentication and gain administrative control.			Data lockout Ransomware encrypts shared files, financial data and client records, disrupting operations.			Backup loss Attackers can erase or encrypt stored endpoint and Microsoft 365 backups, compromising recovery.

3 | Immediate recommended actions

RSM recommends taking these steps immediately:

Containment: If files change or become locked

Isolate the NAS: Disconnect all Ethernet cables to limit network access and potential spread.

Protect backups: Disconnect USB backup drives and restrict access to cloud backups to prevent overwriting healthy copies.

Security hardening

Remove public exposure: Disable NAS port-forwarding rules (5000, 5001, 80 and 443) and router UPnP.

Update systems and packages: Apply security updates via Control Panel > Update & Restore. Update Web Station, PHP and other installed packages in Package Center.

How RSM Hong Kong can assist

RSM Hong Kong's Technology and Management Consulting (TMC) team can help with: