{"id":3936,"date":"2026-11-03T08:46:57","date_gmt":"2026-11-03T08:46:57","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=3936"},"modified":"2026-11-03T08:46:57","modified_gmt":"2026-11-03T08:46:57","slug":"synology-nas-devices-targeted-in-ransomware-attacks-exploiting-patched-dsm-flaw","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=3936","title":{"rendered":"Synology NAS Devices Targeted in Ransomware Attacks Exploiting Patched DSM Flaw"},"content":{"rendered":"<div>\n<p><span class=\"p-author\"><i class=\"icon-font icon-user\">\ue804<\/i><span class=\"author\">Ravie Lakshmanan<\/span><i class=\"icon-font icon-calendar\">\ue802<\/i><span class=\"author\">Nov 03, 2026<\/span><\/span><span class=\"p-tags\">Ransomware \/ Cyber Attack<\/span><\/p>\n<\/div>\n<div id=\"articlebody\">\n<div class=\"separator\" style=\"clear: both;\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEg18lSM19IJpBCuAofy8CZNsJ-05CtvqxdL8BcHUS65fn_Oph-FAXqpdDE9c11G78nq7I1pVtt4XAotc_hszgea-QpNDTt-RzstD3k7yfXHP3JUnBViplsRzL_4q_LM-jujcv6NbMUUYBMWtJKSdKcBYlbSkm7Mx9LaTbVRW88uFh723nDOGYYDxiwkfYFr\/s1700-nu-rw-lo-l85-e365\/synology-ransomware.jpg\" style=\"display: block;  text-align: center; clear: left; float: left;\"><\/a><\/div>\n<p>Synology is urging customers to update the DiskStation Manager (DSM) software powering its Network Attached Storage (NAS) devices following ransomware attacks.<\/p>\n<p>The Taiwanese vendor said it observed threat actors exploiting a vulnerability patched in December 2024 to target devices running outdated versions of DSM.<\/p>\n<p>\u00abThese attacks aim to encrypt data and extort ransom,\u00bb it <a href=\"https:\/\/www.synology.com\/en-global\/company\/news\/article\/C3RB3R\/Synology%20urges%20users%20to%20update%20DSM%20following%20ransomware%20attacks%20on%20outdated%20DSM%20versions\" target=\"_blank\">said<\/a> in a statement released last week.<\/p>\n<p>While Synology did not disclose the exact security flaw that&#8217;s being exploited in these attacks, the company linked to a <a href=\"https:\/\/www.synology.com\/zh-tw\/security\/advisory\/Synology_SA_24_20\" target=\"_blank\">November 2024 security advisory<\/a> that listed three vulnerabilities &#8211;<\/p>\n<ul>\n<li><strong>CVE-2024-10441<\/strong> (CVSS score: 9.8) &#8211; An improper encoding or escaping of output vulnerability in the system plugin daemon of DSM that could lead to remote code execution via unspecified vectors.<\/li>\n<li><strong>CVE-2024-50629<\/strong> (CVSS score: 5.3) &#8211; An improper encoding or escaping of output vulnerability in the webapi component of DSM that could allow remote attackers to read limited files via unspecified vectors.<\/li>\n<li><strong>CVE-2024-10445<\/strong> (CVSS score: 4.3) &#8211; An improper certificate validation vulnerability in the update functionality in DSM that could allow remote attackers to write limited files via unspecified vectors.<\/li>\n<\/ul>\n<p>The issues were addressed in the following versions &#8211;<\/p>\n<ul>\n<li>DSM 7.2.2 &#8211; Upgrade to 7.2.2-72806-1 or above<\/li>\n<li>DSM 7.2.1 &#8211; Upgrade to 7.2.1-69057-6 or above<\/li>\n<li>DSM 7.2 &#8211; Upgrade to 7.2-64570-4 or above<\/li>\n<li>DSM 7.1 &#8211; Upgrade to 7.1.1-42962-7 or above<\/li>\n<li>DSM 6.2 &#8211; Upgrade to 6.2.4-25556-8 or above<\/li>\n<\/ul>\n<p>The development <a href=\"https:\/\/www.reddit.com\/r\/synology\/comments\/1xhqgov\/well_it_finally_happened_my_first_real_ransomware\/\" target=\"_blank\">comes<\/a> amid <a href=\"https:\/\/www.reddit.com\/r\/synology\/comments\/1xhh3zs\/i_got_ransomed_next_step_before_restoration\/\" target=\"_blank\">reports<\/a> from customers that their Synology devices have been hit by C3RB3R ransomware, which has been observed locking users&#8217; files with a \u00ab.L0CK3D\u00bb extension.<\/p>\n<div class=\"dog_two clear\">\n<div class=\"cf\"><a href=\"https:\/\/thehackernews.uk\/network-defense-dd\" rel=\"nofollow noopener sponsored\" target=\"_blank\"><img loading=\"lazy\" decoding=\"async\" class=\"lazyload\" alt=\"Cybersecurity\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEiWypk5aSrjVVXdRpyJaxKDe9VERLYId6cVdoZUwHGSe-EMh90qROsc-jk3uEKqB8-L4eSpBaka7err1zF86IrsEA4S2IZ8yyEsoZTsiGq2YvGuaCtdFvE8-ej7uEBhLbYJNENjs9umU6qmZCJ1aAzvG-ZDO0NtTVddy5hIGv4FBpDJp8UeOxYEzF5AeuK1\/s728-nu-rw-lo-l85-e36\/core-d.png\" width=\"729\" height=\"91\"\/><\/a><\/div>\n<\/div>\n<p>This is not the first time NAS devices have been the target of ransomware attacks. In 2019, NAS devices manufactured by Taiwan-based QNAP Systems were compromised by QNAPCrypt (aka eCh0raix) ransomware. <\/p>\n<p><a name=\"more\"\/><\/p>\n<p>Then, in August 2021, Synology warned of brute-force attacks driven by a malware family called <a href=\"https:\/\/www.malwarebytes.com\/blog\/news\/2019\/02\/new-golang-brute-forcer-discovered-amid-rise-e-commerce-attacks\" target=\"_blank\">StealthWorker<\/a> that led to ransomware infections.<\/p>\n<p>\u00abThese attacks leverage a number of already infected devices to try and guess common administrative credentials, and if successful, will access the system to install its malicious payload, which may include ransomware,\u00bb it <a href=\"https:\/\/www.synology.com\/en-global\/company\/news\/article\/BruteForce\/Synology%C2%AE%20Investigates%20Ongoing%20Brute-Force%20Attacks%20From%20Botnet\" target=\"_blank\">said<\/a> at the time. \u00abDevices infected may carry out additional attacks on other Linux-based devices, including Synology NAS.\u00bb<\/p>\n<p>That same month, Palo Alto Networks Unit 42 also disclosed details of an eCh0raix variant targeting NAS devices from both QNAP and Synology by leveraging vulnerabilities like CVE-2021-28799 or brute-force their way in by making use of commonly used administrative credentials.<\/p>\n<p>\u00abSynology strongly urges all users running vulnerable versions to update DSM immediately to protect their systems,\u00bb the company said. \u00abSynology also recommends enabling automatic updates to keep DSM up to date at all times.\u00bb<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>\ue804Ravie Lakshmanan\ue802Nov 03, 2026Ransomware \/ Cyber Attack Synology is urging customers to update the DiskStation Manager (DSM) software powering its Network Attached Storage (NAS) devices following ransomware attacks. The Taiwanese&hellip;<\/p>\n","protected":false},"author":1,"featured_media":3937,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[24,175,4026,653,70,4025,1707,93,4024,113],"class_list":["post-3936","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-attacks","tag-devices","tag-dsm","tag-exploiting","tag-flaw","tag-nas","tag-patched","tag-ransomware","tag-synology","tag-targeted"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/3936","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3936"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/3936\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/3937"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3936"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3936"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3936"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}