Synology NAS Devices Targeted in Ransomware Attacks Exploiting Patched DSM Flaw

Synology is strongly urging its customers to update the DiskStation Manager (DSM) software that powers its Network Attached Storage (NAS) devices. This warning comes in the wake of active ransomware attacks targeting unprepared users.

• Threat actors are actively exploiting a vulnerability to target devices running outdated versions of DSM.
• The security flaw in question was already patched by the Taiwanese vendor back in December 2024.
• The primary objective of these ongoing attacks is to encrypt user data and extort financial ransom.

Details of the Ransomware Campaign

According to the official statement from the Taiwanese vendor, malicious actors are scanning the web for exposed and unpatched storage units. By leveraging the security gap fixed late last year, attackers manage to gain unauthorized access to vulnerable systems.

The main consequence for victims is the complete encryption of their stored files, rendering critical personal and business data inaccessible. The attackers then demand payment in exchange for the decryption keys, posing a severe operational threat.

Recommended Security Actions

To safeguard against these extortion attempts, Synology advises all administrators to verify their system status and apply the latest DSM updates immediately. Keeping firmware up to date remains the best line of defense.

Users are also encouraged to review network exposure settings, ensure strong passwords are in use, and rely solely on official patches provided by the manufacturer to mitigate similar cybersecurity risks in the future.