Hello!
I have new synology ds923+. Couple of days ago I noticed constant downloading when there should be should be none. I don’t have torrents and cloud services or syncing installed. Downloads can be 5-30 mb/s 
constantly, I have no idea what’s happening. Btw I live in a country where synology support is not available
Are other devices backing up or syncing to your NAS? For example, cellular phone photos, or Synology Drive, Cloud Sync, activate Backup for Business?
No, no services like that, I had web server running but turned it off and everything I could and ds923 was still downloading constantly. So I turned it off completely, the next day I turned it on and vuala, everything is back to normal, it seems, no downloads - and I didn’t change a thing. But I’m worried, maybe my NAS was infected? How could i check it? Also my ISP told me that there was massive DDOS attack on my network provider.
The problem disappeared once ddos attack stopped, today it seems the attacks started again (exactly the same symptoms - very slow and intermittent internet connection with huge pings, very frequent disconnections) and my NAS downloads something constantly when it shouldn’t. DSM is very unresponsive, for example, showing control panel takes couple of minutes. Could it be virus?
How do I even try to solve this?
Edit: when I turned off port forwarding, downloading immediately dropped to 40 kb/s which is still not zero. Turning it on again caused downloads to go to 8 mb/s.
Which port numbers did you open and which derivaten linked to these ports?