Synology NAS Campaign Targets Unpatched DSM With Encryption, Ransom Demands

En bref

• Campaign observed in December 2024 against Synology NAS.
• Entry point is a flaw Synology has already patched.
• Older DSM releases remain exposed.
• Attackers encrypt files and demand payment.
• Admins should apply current DSM updates immediately.

In December 2024, unknown attackers focused on Synology network-attached storage systems whose DiskStation Manager software had not been brought up to date. The entry vector was a security weakness for which the vendor had already issued a repair. After gaining access, the intruders locked stored files through encryption and pressed victims for payment to regain use of their data.

The exposure is concentrated among organizations and individuals still running older DSM builds on their NAS hardware. Because these appliances can hold business and personal data, a successful intrusion can disrupt routine work and create urgent recovery pressure. The campaign's reliance on a flaw that already has a fix makes patching the central defensive action.

This incident fits a broader pattern in which storage appliances become high-value targets: they are internet-accessible in many setups, they centralize data, and they may lag behind on maintenance. The absence of a CVE identifier in the available details does not reduce the risk; defenders should treat the vendor's fixed release as the authoritative signal and verify every unit's version.

What to watch: repeated login attempts, unexpected encryption activity, ransom notes, and DSM version drift across the fleet. Administrators should prioritize internet-facing units, confirm that updates actually installed, and review whether older appliances can be isolated or retired. Synology owners who have not updated DSM since before the fix should act now rather than wait for a second notification.

À faire maintenant

1. Inventory every Synology NAS and record its DSM version; flag any unit below the vendor's fixed release.
2. Install the latest DiskStation Manager update on all exposed appliances, starting with internet-facing systems, and reboot if required.
3. Verify update success by rechecking version numbers and reviewing logs for failed installations.
4. Restrict remote access to NAS management interfaces using firewall rules, VPN, or allowlists; disable unnecessary services.
5. Enable immutable or offline backups and test restoration so encrypted data does not become the only copy.
6. Monitor for unusual file encryption, mass file changes, new admin accounts, and ransom notes; isolate affected units.
7. Retire or isolate NAS models that cannot receive current DSM security fixes.

Source originale

The Hacker News