Synology NAS devices could be under attack from new ransomware threat so update now

Date:
Tue, 03 Nov 2026 17:10:00 +0000

Description:
There's been a wave of attacks against Synology devices and the company urges users to update.

FULL STORY ======================================================================Copy link Facebook X Whatsapp Reddit Pinterest Flipboard Threads Email Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter Subscribe to our newsletter Synology warned of active ransomware attacks exploiting long-patched DSM vulnerabilities on unupdated NAS devices Attackers are reportedly deploying the C3rb3r encryptor and demanding thousands of dollars in ransom Users are urged to patch
immediately, restrict internet exposure, and secure NAS access to prevent compromise Synology, a major network-attached storage (NAS) manufacturer, is warning users about ongoing ransomware attacks targeting devices running outdated software. It urged all users to apply provided patches and secure their devices without delay.

In a brief announcement, Synology said it identified threat actors exploiting a vulnerability patched in December 2024 to target devices running outdated versions of DSM. The goal of the attacks seem to be data encryption and a ransom demand. Synology strongly urges all users running vulnerable versions to update DSM immediately to protect their systems. Synology also recommends enabling automatic updates to keep DSM up to date at all times. Latest Videos From TechRadar Watch full video here: C3rb3r attacks The announcement is rather stingy on the details. We dont know which vulnerability the threat actors are exploiting, where exactly, or how successful they are.

We also dont know how many devices are at risk - the Shadowserver Foundation tracks a total of 380,000 internet-connected endpoints (many of which are, most likely, running the latest software version and are thus protected). You may like PHP security issues could also threaten your NAS device but not every vendor is able to patch just yet Kiteworks tells users to shut down servers amid fears of 'imminent' cyberattack Hackers turn business backup servers into crypto mines after sneaking malware disguised as Microsoft Edge

The company also did not say who the threat actors are, but according to BleepingComputer , there has been a massive wave of reports from Synology customers whose data was apparently locked down by the C3rb3r encryptor.
These customers were asked to pay thousands of dollars in ransom, in exchange for the decryption key. The publication says the first reports started surfacing more than two weeks ago.

There are two main ways for cybercriminals to access an electronic device and encrypt the data found there - either by exploiting a zero-day vulnerability (one that has not yet received a patch), or by exploiting years-old n-day vulnerabilities (ones that were patched months ago) on devices that were
never updated and secured. Are you a pro? Subscribe to our newsletter Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features
and guidance your business needs to succeed! Contact me with news and offers from other Future brands Receive email from us on behalf of our trusted partners or sponsors By submitting your information you agree to the Terms & Conditions and Privacy Policy and are aged 16 or over.

With Synology users, the latter seems to be the case. The company said the attackers were exploiting a vulnerability patched in December 2024, and
linked to a November 2024 security advisory, in which it listed three fixed bugs: CVE-2024-10441 (arbitrary code execution), CVE-2024-50629 (arbitrary file read), and CVE-2024-10445 (a bug that allows writing files on
compromised devices).

DSM 7.2.2 owners should upgrade to 7.2.2-72806-1 or above, DSM 7.2.1 to 7.2.1-69057-6 or above, and DSM 7.2 to 7.2-64570-4 or above. DSM 7.1 should upgrade to 7.1.1-42962-7 or above, while those running DSM 6.2 to 6.2.4-25556-8 or above. Only in the last version - 6.2 - is the vulnerability labeled as moderate. In all other cases it was deemed critical. Why are NAS devices being targeted? NAS devices are dedicated storage systems that businesses can connect to their local network and allow employees to access, share, and manage files stored in a centralized location. They are rather popular among SMBs that lack the resources to maintain a more complex enterprise storage infrastructure. What to read next Citrix says two worrying NetScaler RCE zero-days exploited in attacks Synology reveals a host of new NAS devices it says can balance budget and power requirements for all users Hackers are breaking into company networks via hacked CCTV camera software

Besides being used as a hybrid cloud of sorts, NAS is also used to store business documents and often acts as a centralized backup. The relative low cost, straightforward deployment, and easily expandable storage capacity
makes NAS devices an attractive alternative to both dedicated file servers
and cloud storage subscriptions.

However, this also makes them a valuable target for cybercriminals, as weve seen in this Synology case. The best way to defend against ransomware attackers is to either completely pull the NAS from the public internet or at least limit access to a handful of vetted identities. Keeping the devices updated with the latest firmware and software is also recommended.

It is worth mentioning that NAS devices usually come with RAID redundancy and built-in backup features, but these do not necessarily protect against ransomware encrypting the stored data. The best antivirus for all budgets Our top picks, based on real-world testing and comparisons

Read our full guide to the best antivirus 1. Best overall: Bitdefender Total Security 2. Best for families: Norton 360 with LifeLock 3. Best for mobile: McAfee Mobile Security Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.



======================================================================
Link to news story: https://www.techradar.com/pro/security/synology-nas-devices-could-be-under-att ack-from-new-ransomware-threat-so-update-now


--- Mystic BBS v1.12 A49 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)