The antivirus said 'no malware detected'. It was sitting right there on the disk.
A real incident, and a lesson about green lights. Every command output, version number and CVE ID below is from the actual investigation. Nothing was invented for the narrative. It started with an unrelated question I was tidying up scheduled tasks on my Synology NAS and opened Task Scheduler. Two entries I didn't remember creating: PowerOff task 0 → 2026-07-26 09:00 PowerOn task 0 → 2026-07-26…
This real-life incident serves as a cautionary tale about the limitations of security tools. A user discovered hidden, malicious scripts on their Synology NAS. Running a malware scan produced three green checkmarks confirming no threats were detected. However, the malicious files were still present. The source reveals three key reasons why the scan missed the threat:
1. The malware was packed using UPX, a compression tool that hides strings inside executables, rendering signature-based scanners ineffective.
2. The dropper used an ordinary shell script rather than a traditional virus format. While each line appears legitimate, the combination of commands poses a malicious threat, which signature scanners do not account for.
3. The cron job syntax was valid, allowing the malicious script to run at regular intervals. Signature checks look for known bad templates rather than analyzing what the script actually does.
This highlights the disparity between a security tool's assurance (no threats detected) and the actual presence of a threat. The attacker exploited an unpatched vulnerability in Synology's software (CVE-2024-10441), which allowed remote code execution without authentication. The vulnerability existed in older builds of Synology's DSM software that the user was still running. Additionally, QuickConnect, Synology's remote access feature, exposed the device to the internet without proper port forwarding.
To remove the threat, the user had to carefully delete both the malicious cron entries and the files themselves. Simply deleting the files is not enough, as the malware is designed to reinfect the system. The only way to ensure complete removal is to trigger a full system check after deleting the files, which takes about 20 minutes.
The user confirmed the threat was gone by running a full scan and checking for indicators of compromise. This incident emphasizes the importance of keeping software updated and understanding the limitations of security tools.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
