Skip to content
securitytabs

LiveUpdated

Synology warns of ransomware attacks on NAS devices running outdated DSM

Synology says criminals are locking files on its network storage devices that have not been updated, and demanding a ransom. Owners of Synology storage should check that their devices run current software now.

Ransomware hits outdated Synology NAS devices
Ransomware hits outdated Synology NAS devices

What's new

Newest coverage

TimelineWhat should my organization do?

What happened

Synology, the Taiwanese maker of network-attached storage (NAS) devices, warned customers to update their devices immediately after a surge in attacks involving C3RB3R ransomware, according to BleepingComputer's report of the warning. [1]

Synology said it observed threat actors exploiting a vulnerability patched in December 2024 to target devices running outdated versions of its DiskStation Manager (DSM) operating software. It said the attacks aim to encrypt data and extort ransom. [2][3]

Who is affected

The attacks target NAS devices that still run outdated DSM versions, putting the files stored on them at risk. The fix has been available since 2024, so devices that were updated after it was released are not described as targets. [3][2]

What is not yet known

The coverage seen so far does not give a CVE identifier for the flaw, the number of affected devices, or technical indicators of compromise. Synology's statement urges customers to update DSM. [2][3]

Timeline

  1. Synology urged owners of devices running outdated DSM to update immediately. [3]

  2. Synology said attackers were exploiting a flaw patched in December 2024 on outdated DSM versions. [2]

  3. Synology warned customers to update their NAS devices after a surge in C3RB3R ransomware attacks. [1]

Explained

The technology and terms in this story. Learn more

Business ActionWhat this means inside your organization, and what to do about it, by company size.

Small business

No dedicated security staff; relies on providers

What to know

Synology says attackers are encrypting files on NAS devices that run outdated DSM software and demanding payment. [2]

What to do

  1. Check which DSM version your Synology device runs and update it, as Synology urges. [2][3]
  2. Ask your IT provider whether any Synology devices are in use at your business. [1]

Mid-size company

A small IT or security team

What to know

The exploited flaw was patched in December 2024, so the exposure is on devices that were never updated. [2][3]

What to do

  1. Inventory Synology NAS devices and confirm each runs a current DSM release. [2]
  2. Update outdated devices immediately, as Synology advises. [1][3]

Large enterprise

A security operations team

What to know

Synology has not published indicators in the coverage seen so far; the known risk is unpatched DSM in the estate. [2][3]

What to do

  1. Identify all Synology NAS devices, including unmanaged ones, and verify DSM versions against the vendor's patched release. [2]
  2. Update outdated devices immediately and watch Synology's advisories for further detail on the attacks. [1][3]

Sources

  1. [1]BleepingComputer · Nov 2, 11:28 UTC
    Synology warns of C3RB3R ransomware attacks targeting NAS devicescontext
  2. [2]The Hacker News · Nov 3, 07:43 UTC
    Synology NAS Devices Targeted in Ransomware Attacks Exploiting Patched DSM Flawcontext
  3. [3]Security Affairs · Nov 3, 16:31 UTC
    Synology Warns of Ransomware Attacks Targeting NAS Devices Running Outdated DSM Versionscontext