Synology Warns of Ransomware Exploits Targeting Unpatched NAS Devices After December Patch

Synology, the Taiwanese maker of network‑attached storage (NAS) solutions, has issued an urgent advisory urging owners to install the latest DiskStation Manager (DSM) update. The call follows a wave of ransomware attacks that appear to be leveraging a security flaw that was originally patched in December 2024, but remains unaddressed on many installations.

The ransomware campaigns have been observed targeting the DSM operating system that powers Synology's NAS appliances, which are widely used by small businesses, home offices, and enterprises for file sharing and backup. Threat actors are exploiting the previously disclosed vulnerability to gain unauthorized access, encrypt stored data, and demand payment. While the exact number of compromised devices has not been disclosed, the incidents have prompted security researchers to warn that any system still running pre‑patch versions is at heightened risk.

Synology's advisory stresses that the December 2024 patch closed a critical remote code execution pathway that could allow attackers to run arbitrary commands on the device. Because the flaw affects the core management interface, it can be abused without requiring physical access. The company recommends that all users verify they are on DSM version 7.2.4 or later, enable automatic updates, and review any unusual login activity in system logs.

Ransomware operators have increasingly turned to NAS platforms as a lucrative vector, given the large volumes of data they store and the often limited security controls in place. Industry analysts note that the shift reflects a broader trend of attackers moving beyond traditional endpoints to compromise backup and storage infrastructure, thereby increasing leverage over victims. The Synology incidents underscore the importance of maintaining a disciplined patch management process, especially for devices that remain online continuously.

Looking ahead, Synology says it will continue to monitor the situation and work with cybersecurity partners to track the threat actors behind the attacks. Users are encouraged to back up critical data to an offline location and to consider multi‑factor authentication for DSM accounts. As the ransomware landscape evolves, timely software updates remain one of the most effective defenses against exploitation of known vulnerabilities.