Patched Synology DSM flaw is being used to ransom outdated NAS boxes

Synology says attackers are using a DSM vulnerability patched in December 2024 to encrypt data on unpatched NAS devices and demand payment. That is a very specific warning, and a useful one.

A vulnerability patched in December 2024 is now being used to encrypt data on Synology NAS devices that are still running older DSM versions.

That is the most concrete part of Synology’s warning, and it is the unusual part too.

Vendors often tell people to update because a bug could be abused. This time the message is narrower and more serious: Synology says it has observed attackers exploiting that already-fixed DSM flaw in ransomware attacks. Not a hypothetical risk. A live one.

Why a NAS is such an attractive target

A NAS is the box that often ends up holding the files everyone cares about.

Family photos. Team documents. Backups. Media libraries. Archived project folders. Sometimes all of it sits in one place, powered on all the time, and reachable over the network.

For an attacker, that is a tempting setup. If they can get in and encrypt the contents, they do not need to steal every laptop one by one. It is more like putting a lock on the filing room instead of each individual drawer.

That is why ransomware hitting a NAS feels different from a random malware infection on one computer. The blast radius can be much bigger.

Synology said these attacks are meant to encrypt data and extort a ransom. That tracks with how ransomware operators usually work: deny access first, then use urgency as leverage.

The patched-flaw part is the real signal

The detail that matters is not just “ransomware is targeting NAS devices.” That has happened before in one form or another.

The stronger signal is that the entry point was reportedly fixed already, back in December 2024, and attackers are going after devices that missed the update.

That tells you two things.

First, attackers are watching vendor patches closely. When a company fixes a security issue, criminals often study that fix to work out what changed and how to exploit systems that have not been updated yet.

Second, the long tail of old versions is still easy prey. Plenty of NAS devices get set up once and then fade into the background. They are quiet, useful, and easy to forget. Like a smoke alarm with an old battery, they seem fine until the day they really are not.

A patched flaw turning into active ransomware is a reminder that delayed updates are not a paperwork problem. They are a direct exposure.

What Synology users should do now

If you have a Synology device, the practical response is straightforward.

• Update DSM to the latest version available for your device.
• Check whether the device is exposed to the internet. If it does not need outside access, turn that off.
• Review remote access settings and disable anything you no longer use.
• Make sure you have backups that are separate from the NAS itself.
• Test that those backups can actually be restored.
• Review user accounts and remove old ones or accounts with more access than they need.

That last backup point matters more than people think.

A backup stored only on the same device, or mounted in a way ransomware can also reach, is not much of a safety net. Good backups need some separation. Different system, different access path, or a copy that cannot be altered once written.

If you manage a NAS for a small business, this is also a good time to check whether update notifications are being seen by an actual human. A lot of damage comes from devices that nobody quite owns.

And if you are behind on updates because you are worried about compatibility, that concern is fair. But the risk has changed once active attacks are in play. When attackers are already using a fixed bug to encrypt data, waiting carries its own cost.

A storage box is not just storage anymore.

It is a small server that holds some of your most valuable data, and it needs to be treated that way. Synology’s warning is useful because it is specific: attackers are exploiting an older DSM weakness that was patched in December 2024, and the apparent goal is ransomware.

If your device is not up to date, fix that first. Then make sure your backups are real, separate, and recoverable. That is the practical path that gives you the best odds if this kind of attack reaches your network.