Ransomware Operators Encrypt Files on Unpatched Synology NAS Systems

Key points

• Ransomware operators are targeting Synology network-attached storage.
• Devices running older DiskStation Manager releases are the exposed group.
• Reported impact includes file encryption and disrupted access.
• No CVE is associated with this activity; updating DSM is the main defense.

In 2024, ransomware operators have been focusing on Synology network-attached storage systems, particularly units managed through DiskStation Manager. The reported effect is encryption of files and interruption of normal access, with administrators of older DSM releases facing the greatest exposure. Synology is warning customers about the risk and pressing them to bring their software up to date.

The scale of the problem is tied to installations that have fallen behind on DSM updates. Because no CVE identifier has been published for this activity, defenders cannot simply search for a single vulnerability and patch it. Instead, the warning points to routine maintenance and configuration discipline as the practical safeguards for storage systems that may be reachable from the internet or used for remote access.

For K-12 and government environments, NAS appliances often hold shared documents, operational files, and backup copies. Encryption on those systems can quickly disrupt daily work and complicate recovery, especially if the only backup sits on the same device or network. That makes unpatched storage a high-value target even when no named vulnerability is involved.

Administrators should treat this as a reminder that edge storage needs the same attention as servers and endpoints. Watch for updated Synology guidance, reports of encrypted files or ransom notes, unusual DSM logins, and signs that remote access paths are being abused. The immediate priority is to identify lagging DSM versions, update them, and reduce how much of the NAS management surface is exposed.

What to do now

1. Inventory every Synology NAS and record its DSM version, model, and internet exposure.
2. Back up configuration and critical data, then apply the latest available DSM update to outdated systems.
3. Remove direct public access to DSM administration interfaces and require VPN or another controlled access path.
4. Enforce multifactor authentication, unique admin credentials, and disable unused or default accounts.
5. Confirm that backups are offline or immutable and test a restore before relying on them.
6. Review NAS logs for unusual logins, mass file changes, encryption activity, or ransom notes.
7. Segment storage systems from general user networks and limit unnecessary file-sharing services.

Original source

Security Affairs