Synology warns of ransomware attacks on outdated DSM NAS systems

Synology has urged customers to update DiskStation Manager (DSM) after observing ransomware attacks against its network-attached storage (NAS) devices. The company said threat actors are exploiting a vulnerability that was patched in December 2024 on systems still running outdated DSM releases.

The attacks are intended to encrypt data and extort victims. Reports from affected customers have associated the activity with C3RB3R ransomware, which locks files and adds the .L0CK3D extension.

Patched DSM versions are being targeted

Synology did not specify which vulnerability is being used in the current attacks. Its alert points customers to a November 2024 advisory covering three DSM vulnerabilities, including CVE-2024-10441, rated 9.8 on the CVSS scale.

CVE-2024-10441 is an improper encoding or escaping of output flaw in DSM's system plugin daemon. Synology said it could enable remote code execution through unspecified vectors. The advisory also lists CVE-2024-50629, a 5.3-rated issue in the WebAPI component that could let remote attackers read limited files, and CVE-2024-10445, a 4.3-rated certificate-validation weakness in DSM update functionality that could allow limited file writes.

The fixes are available in DSM 7.2.2-72806-1 or later, DSM 7.2.1-69057-6 or later, DSM 7.2-64570-4 or later, DSM 7.1.1-42962-7 or later, and DSM 6.2.4-25556-8 or later. Organizations running older releases should establish which supported branch applies to each device before updating.

NAS ransomware remains a recurring risk

NAS appliances have repeatedly attracted ransomware operators. In 2019, QNAP Systems devices were compromised by QNAPCrypt, also known as eCh0raix. In August 2021, Synology warned that StealthWorker malware was using already infected devices to guess common administrative credentials, install malicious payloads and attack other Linux-based devices, including Synology NAS systems.

That month, Palo Alto Networks Unit 42 described an eCh0raix variant targeting QNAP and Synology NAS devices through vulnerabilities such as CVE-2021-28799 or by brute-forcing commonly used administrative credentials. The latest advisory again places software maintenance at the centre of NAS defence.

Operational priority for storage teams

Synology strongly recommends that users of vulnerable DSM versions update immediately and enable automatic updates. For businesses, the practical implication is to inventory NAS devices, verify the installed DSM build against Synology's fixed versions, and test backup recovery so an encryption event does not become a prolonged storage outage.