Synology NAS hit by ransomware due to old unpatched flaw

System administrators are often quick to point out security flaws in other setups, but they can occasionally fall victim to the very same oversights. Reddit user NakamuraHwang experienced a harsh reminder of this reality when files on their Synology DS918+ network-attached storage device were locked by a ransomware attack following a series of configuration mistakes.

• A Synology NAS device was targeted by ransomware because its web interface was exposed to the web and security updates were 18 months out of date.
• Log analysis revealed the attackers likely exploited the CVE-2024-10441 remote code execution vulnerability disclosed a year and a half ago.
• The owner had a 3-2-1 backup strategy in place, meaning no permanent data loss occurred after moving disks to a Proxmox machine for inspection.

Configuration Errors and the Vulnerability

Hwang provided a detailed breakdown of the incident, noting that the unit's web interface was directly accessible from the internet without intermediate protection layers. Furthermore, security patches had been neglected for roughly a-year-and-a-half. Industry best practices dictate that exposing administrative panels directly to the public internet without a VPN or SSH tunnel, such as Tailscale, invites inevitable compromises.

Inspection of system logs and DSM operating system files indicated the breach stemmed from the abuse of CVE-2024-10441. Because Synology's DSM uses mdraid underneath, the owner was able to safely extract the physical drives and mount them on a separate Proxmox hardware machine to perform a forensic review.

Update Quirks on Synology Hardware

The incident also highlights ongoing confusion regarding how Synology handles software updates. Forum discussions point out that the DSM user interface can sometimes report that a system is fully up to date while critical security components still require manual intervention. While units manufactured from 2025 onward feature automatic updates, legacy hardware requires explicit manual configuration.

Additionally, older units like the Synology 918+ will not automatically upgrade to major newer versions of DSM because doing so might deprecate older software packages. Users must intentionally trigger upgrades and ensure that package-level updates, such as PHP patches, are manually applied as well.

Key Takeaways for Administrators

This security event underscores the vital importance of strict network hygiene for both home labs and enterprise environments. Exposing administrative appliances directly to the internet is a massive risk, and administrators should always rely on secure remote access solutions like VPNs, while actively verifying patch statuses rather than trusting default UI notifications.