Ransomware Hits Synology Devices Using a Patched Flaw

Ransomware is targeting Synology NAS devices by exploiting an old, patched vulnerability. Synology urges users to update their DSM software now.

Synology has issued a critical alert for its customers, warning of an active ransomware campaign targeting its Network Attached Storage (NAS) devices. According to the company's statement, first reported by The Hacker News, threat actors are actively exploiting a known vulnerability in the DiskStation Manager (DSM) operating system. The attacks are designed to encrypt all data stored on the device, after which the attackers demand a ransom for its release. The most concerning detail is that the vulnerability being used was discovered and patched by Synology back in December 2024, meaning these attacks are only succeeding against devices running outdated software. The company is strongly urging all users to update their DSM software to the latest version to protect themselves from this ongoing threat.

The attack mechanism is a classic example of threat actors capitalizing on delayed patch cycles. The vulnerability allows attackers to gain unauthorized access to a Synology NAS device if it is exposed to the internet and running an unpatched version of DSM. Ransomware groups are systematically scanning the web for these vulnerable devices, which act as low-hanging fruit. Once a target is identified, the exploit is deployed to gain administrative control. With full access, the attackers then execute their ransomware payload, which rapidly encrypts every file on the device's storage drives. This automated scan-and-exploit technique allows them to target thousands of potential victims with minimal effort, relying on the statistical probability that a significant number of administrators have not yet applied the critical security update that has been available for months.

This incident fits into a broader, well-established trend of ransomware gangs specifically targeting NAS devices. Hardware from manufacturers like Synology and QNAP has become a favorite target because these devices often serve as the central repository for a company's most valuable assets, including primary data, file shares, and, critically, backups. A successful attack on a NAS can be devastating, as it not only locks up operational data but can also neutralize the very backups intended for recovery. Previous ransomware campaigns like DeadBolt and Qlocker have demonstrated the effectiveness of this strategy, causing widespread disruption. Attackers know that these devices are frequently made internet-accessible for remote work but may not be as rigorously monitored or patched as traditional servers, creating a perfect storm of high value and lagging security hygiene.

The primary takeaway for all IT and security teams is the non-negotiable importance of diligent patch management. This attack serves as a stark reminder that the existence of a patch provides no protection on its own; it must be deployed. Organizations should immediately audit all Synology devices on their networks and apply the latest DSM updates. Beyond this immediate action, teams should review their security posture regarding these devices. This includes enabling automatic updates, restricting public internet access to the DSM management interface wherever possible, and enforcing strong, unique passwords. Most importantly, it validates the 3-2-1 backup rule: maintain at least three copies of your data, on two different types of media, with one copy stored securely offsite and offline. This ensures that even if a NAS and its local backups are compromised, a clean copy of the data is available for restoration.

This attack highlights the critical danger of unpatched systems, even when a fix has been available for months. For teams using Synology NAS for backups or primary storage, a successful attack could mean catastrophic data loss and significant operational disruption, bypassing other security layers.

A ransomware attack on a company's NAS can halt operations by encrypting critical business data, backups, and intellectual property. The financial impact includes not only potential ransom payments but also costly downtime, data recovery efforts, and reputational damage with customers and partners.