Synology Warns Customers as Ransomware Campaign Hits Outdated NAS Devices

Synology has issued an urgent advisory urging customers to update DiskStation Manager (DSM), the operating system that runs its Network Attached Storage (NAS) devices, after the company observed ransomware attacks in the wild. According to the Taiwanese vendor, threat actors are exploiting a vulnerability that was patched back in December 2024 to compromise devices still running outdated DSM versions.

In its statement, Synology described the campaign's intent bluntly: "These attacks aim to encrypt data and extort ransom." The advisory was first reported by The Hacker News.

Why NAS Devices Are a Prime Target

Network Attached Storage appliances occupy a uniquely attractive position in modern IT environments. They are typically deployed as centralized repositories for backups, shared documents, media libraries, and in many small businesses, the only copy of critical operational data. That concentration of value makes them a high-leverage target for extortion-focused actors: encrypting a single NAS can disrupt an entire organization's access to its files and, critically, to the backups that would otherwise enable recovery.

NAS devices are also frequently internet-exposed to support remote access, file synchronization, and mobile apps, expanding the attack surface considerably. When a device sits behind an unpatched firmware version, it can remain exploitable long after a fix has been published.

The Patch Gap Is the Story

The most significant detail in this campaign is the timeline. The flaw in question was addressed in December 2024, meaning defenders have had a substantial window to apply the update. The fact that attackers are still successfully compromising devices nearly a year later underscores a persistent problem across the storage and IoT space: patching rates for appliances lag far behind patching rates for endpoints and servers.

There are structural reasons for this. NAS appliances are often "set and forget" infrastructure, deployed by a reseller or IT generalist and then left to run for years without a maintenance schedule. Administrators may be wary of firmware updates disrupting services, or may simply lack an inventory of which devices on their network are running which DSM version. Whatever the cause, the outcome is the same: a known, fixable vulnerability remains a viable entry point.

Recommended Actions for Defenders

Synology's guidance centers on updating DSM to a current release. Beyond that core step, security teams should consider the following measures:

  • Audit DSM versions across the estate. Identify every Synology device, including branch-office and departmental units that may have escaped central inventory, and confirm the installed DSM build.
  • Apply updates promptly and verify. After patching, confirm the new version is active rather than assuming a scheduled update succeeded.
  • Reduce internet exposure. Where remote access is not essential, disable it. Where it is required, restrict access through a VPN or firewall allowlist rather than leaving DSM management interfaces reachable from the public internet.
  • Enforce strong authentication. Enable multi-factor authentication on accounts with administrative access to the appliance and remove or disable default and dormant accounts.
  • Maintain offline, immutable backups. Ransomware that targets storage specifically is designed to destroy recovery options. Keep at least one backup copy that is not reachable from the NAS itself.
  • Monitor for anomalous behavior. Sudden mass file renaming, unusual outbound connections, or unexpected account logins on a storage appliance warrant immediate investigation.

The Broader Pattern

This campaign fits a well-established pattern in which ransomware operators opportunistically scan for internet-facing appliances running known-vulnerable software. Storage systems, VPN concentrators, and edge devices have all featured repeatedly in such activity because they combine high data value with infrequent patching.

For organizations, the takeaway is less about any single Synology flaw and more about lifecycle discipline: know what is on your network, know what version it runs, and treat firmware updates for infrastructure appliances with the same urgency as operating system patches on servers. Attackers are counting on the gap between disclosure and deployment, and in this case, that gap has been measured in months.

Synology customers who have not yet updated DSM should treat the update as urgent, particularly if their devices are reachable from the internet.