Ransomware targets unpatched Synology NAS devices

SecurityOnline reports a ransomware campaign against Synology network-attached storage (NAS) devices, saying it has encrypted storage volumes and primarily affected internet-exposed appliances running outdated software. It attributes the attacks to the exploitation of known vulnerabilities, rather than zero-days. The outlet cites Synology’s SA-24:20 advisory for CVE-2024-10441, a flaw in internal plugin services that the advisory rates 9.8 on the CVSS scale.

The vulnerability could allow unauthenticated remote code execution through malformed network requests. SecurityOnline also says Qihoo 360 analysts observed exploitation of other flaws patched in September 2026; it does not identify those vulnerabilities or provide details of specific victims.

Synology’s listed minimum fixed versions are DSM 7.4-90075, DSM 7.3.2-86009-4, DSM 7.2.2-72806-9 and DSM 7.2.1-69057.12. The outlet says DSM 6.x has reached end of life and will not receive security fixes. It advises administrators to update devices, remove direct public access where possible, and use WireGuard tunnels if remote access is required. It also recommends multi-factor authentication and offline, immutable backups, with version history and rollback for remote copies.