Synology warns of ransomware attacks on outdated NAS devices

Active ransomware attacks on Synology NAS devices

Synology has issued a warning about active ransomware attacks targeting its network-attached storage (NAS) devices running outdated versions of its DiskStation Manager (DSM) software. According to reports, threat actors are exploiting a vulnerability patched in December 2024 to deploy the C3rb3r encryptor, which encrypts data and demands ransoms amounting to thousands of dollars.

Vulnerabilities and patches

The vulnerability being exploited was addressed in a series of patches released in late 2024. Synology fixed three critical vulnerabilities in November 2024: CVE-2024-10441, CVE-2024-50629, and CVE-2024-10445. Users are urged to update their DSM software to the following versions or later:

• DSM 7.2.2-72806-1 or above

• DSM 7.2.1-69057-6 or above

• DSM 7.2-64570-4 or above

• DSM 7.1.1-42962-7 or above

• DSM 6.2.4-25556-8 or above.

Failure to apply these updates leaves devices exposed to the ongoing ransomware campaign.

Scope of the threat

The Shadowserver Foundation, a cybersecurity monitoring organization, reports that approximately 380,000 internet-connected endpoints may be at risk. NAS devices are particularly attractive to cybercriminals due to their role in storing business-critical documents and backups. Small and medium-sized businesses (SMBs) often rely on these devices for their cost-effectiveness and expandable storage capabilities.

Why NAS devices are high-value targets

NAS devices are a cornerstone of data storage and backup strategies for many businesses, particularly SMBs. Their popularity stems from their affordability, ease of deployment, and scalability. However, their connectivity to the internet and frequent use for storing sensitive or business-critical data make them prime targets for ransomware attackers. Experts recommend isolating NAS devices from the public internet or restricting access to authorized identities to mitigate risks.

Previous vulnerabilities in NAS devices

This is not the first time Synology NAS devices have been targeted by cyber threats. Earlier reporting highlighted critical vulnerabilities in PHP, dubbed PHP2Shell, which affected NAS devices from Synology, QNAP, and other manufacturers. While Synology released patches for those vulnerabilities, other vendors were slower to respond, leaving devices exposed to remote code execution and potential data breaches.

What this means

Lazyfounder analysis — our interpretation, not reported fact.

For founders and operators relying on NAS devices for data storage or backups, this incident is a reminder of the critical importance of timely software updates. Ransomware attacks on NAS devices can disrupt business operations, lead to data loss, and incur significant financial costs. The speed at which vulnerabilities are exploited—often within weeks of patches being released—highlights the need for automated update processes and robust cybersecurity practices. Businesses using Synology or other NAS solutions should prioritize securing these devices, as they are increasingly targeted by cybercriminals seeking high-value data.

Related on Lazyfounder

• Synology
• PHP2Shell vulnerabilities expose NAS devices from Synology, QNAP, and others
• More technology news