Synology NAS Devices Targeted in Ransomware Attacks Exploiting Patched DSM Flaw Ravie LakshmananNov 03, 2026Ransomware / Cyber Attack Synology is urging customers to update the DiskStation Manager (DSM) software powering its Network Attached Storage (NAS) devices following ransomware attacks. The Taiwanese vendor said it observed threat actors exploiting a vulnerability patched in December 2024 to target devices running outdated versions of DSM. "These attacks aim to encrypt data and extort ransom," it said in a statement released last week. While Synology did not disclose the exact security flaw that's being exploited in these attacks, the company linked to a November 2024 security advisory that listed three vulnerabilities - CVE-2024-10441 (CVSS score: 9.8) - An improper encoding or escaping of output vulnerability in the system plugin daemon of DSM that could lead to remote code execution via unspecified vectors. CVE-2024-50629 (CVSS score: 5.3) - An improper encoding or escaping of output vulnerability in the webapi component of DSM that could allow remote attackers to read limited files via unspecified vectors. CVE-2024-10445 (CVSS score: 4.3) - An improper certificate validation vulnerability in the update functionality in DSM that could allow remote attackers to write limited files via unspecified vectors. The issues were addressed in the following versions - DSM 7.2.2 - Upgrade to 7.2.2-72806-1 or above DSM 7.2.1 - Upgrade to 7.2.1-69057-6 or above DSM 7.2 - Upgrade to 7.2-64570-4 or above DSM 7.1 - Upgrade to 7.1.1-42962-7 or above DSM 6.2 - Upgrade to 6.2.4-25556-8 or above The development comes amid reports from customers that their Synology devices have been hit by C3RB3R ransomware, which has been observed locking users' files with a ".L0CK3D" extension. This is not the first time NAS devices have been the target of ransomware attacks. In 2019, NAS devices manufactured by Taiwan-based QNAP Systems were compromised by QNAPCrypt (aka eCh0raix) ransomware. Then, in August 2021, Synology warned of brute-force attacks driven by a malware family called StealthWorker that led to ransomware infections. "These attacks leverage a number of already infected devices to try and guess common administrative credentials, and if successful, will access the system to install its malicious payload, which may include ransomware," it said at the time. "Devices infected may carry out additional attacks on other Linux-based devices, including Synology NAS." That same month, Palo Alto Networks Unit 42 also disclosed details of an eCh0raix variant targeting NAS devices from both QNAP and Synology by leveraging vulnerabilities like CVE-2021-28799 or brute-force their way in by making use of commonly used administrative credentials. "Synology strongly urges all users running vulnerable versions to update DSM immediately to protect their systems," the company said. "Synology also recommends enabling automatic updates to keep DSM up to date at all times." Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. Cyber Attack, data security, network security, ransomware, Vulnerability Why Urgent Security Fixes Aren't Fixed. Observe, Prove, Act, Confirm Gets Them Moving PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen Chinese Hackers Use AI-Powered ARTEX to Target Over 200 Organizations Worldwide CyberStrikeAI Uses 44 AI Agents to Automate Hacking Operations Against Japan Targets Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens Anthropic's Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits American Organizations Under Attack: Skyw4lker Device Code Phishing Campaign Exposed Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility The Rise of the Threat Operator: How AI Will Redefine Security Operations and Careers PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network TeamViewer Flaw Lets Remote Computers Attack Users Who Connect to Control Them Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software AI-Generated Fake Login Pages Are Making Account Takeovers Easier Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls Critical 16-Year-Old UEFI Flaw Can Run Code Before Secure Boot on Network-Booting Servers GoAhead TLS Flaws Allow Revoked Client Certificates and Enable Session Decryption ThreatsDay: Critical Firewall Flaws, Banking Trojans Rented, Weaponized PDF, Token Theft + 26 More Stories Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor Assess Your Organization's AI Code Sprawl Exposure With This Practical Guide Beyond CVE Scanning: Book a Demo of Continuous AI-Powered Web Pentesting See How Bitdefender GravityZone Identifies Shadow AI and Prioritizes Endpoint Risks Detect Lateral Movement and Evasive Attacks With Corelight's Open NDR Platform Your SOC Has an Identity Blind Spot. Here's How to Fix It Learn how to close critical identity visibility gaps in your SOC, detect hidden threats, and accelerate incident response across human, machine, and AI identities. Join the Session Roadmap for AI-Ready Security Operations Evaluate Attack Surface Visibility With an AI Threat Readiness Framework Learn how to assess AI threat readiness, strengthen attack surface visibility, and prepare security operations for emerging threats in this practical webinar. BeyondTrust an 8X Gartner® Magic Quadrant™ Leader for PAM Gain clarity on the PAM market and understand why BeyondTrust is again a Leader. The 2026 Identity Crisis: Why Your IAM is Only Half the Story Stop driving blind. See the identity blind spots traditional IAM misses. Watch now. Governance Sets the Ceiling on Your AI Security Program See the five moves that raise a Stage 2 Govern score to a defensible Stage 3. 11 Real Stories: How Identity Exposure Unlocks Active Attack Paths Map cross-domain privilege escalation to sever breach routes at key choke points. The MSP Margin Math Nobody's Doing: Your Next Technician Might Already be on Payroll PEDM vs. Standing Elevated Privileges: Control Access Without Flooding the Helpdesk Your Backup Isn't Ransomware-Proof Just Because It Exists Why Root and Jailbreak Detection Alone Cannot Guarantee Mobile App Security