Synology Warns NAS Owners to Update Now as Ransomware Hits Unpatched Devices

Synology is urging customers to update the DiskStation Manager (DSM) software that runs its Network Attached Storage (NAS) devices after ransomware attacks. The Taiwanese vendor said threat actors are exploiting a vulnerability that was patched in December 2024, and are targeting devices still running outdated versions of DSM. In its statement, Synology said the attacks aim to encrypt data and extort a ransom.

Synology did not name the specific flaw being exploited. It pointed customers to a November 2024 security advisory that listed three vulnerabilities. Separately, customers have reported that their devices were hit by C3RB3R ransomware, which locks files and gives them a ".L0CK3D" extension.

NAS devices have been targeted before. In 2019, QNAP devices were compromised by QNAPCrypt (also known as eCh0raix) ransomware. In August 2021, Synology warned of brute-force attacks by a malware family called StealthWorker, which guessed common administrative credentials and could lead to ransomware infections. That same month, Palo Alto Networks Unit 42 described an eCh0raix variant that targeted both QNAP and Synology devices, using known vulnerabilities or commonly used administrative credentials. Synology strongly urges all users running vulnerable versions to update DSM immediately, and recommends turning on automatic updates. This summary is based on the opening of the source article only.