Synology NAS ransomware attacks exploit a flaw patched nearly a year ago

Synology is urging customers to update their DiskStation Manager (DSM) software after threat actors were observed actively exploiting a vulnerability patched in December 2024 to deliver ransomware, according to The Hacker News. The attacks target Synology NAS devices running outdated versions of DSM, with the goal of encrypting stored data and demanding a ransom payment. Synology confirmed the activity in a public statement, noting that the vulnerability is known, the patch has been available for nearly a year, and the exploitation is ongoing. For affected organisations, the risk is entirely avoidable through timely patching.

Why this matters for UK organisations

Synology NAS devices are widely deployed across UK businesses of all sizes, commonly used for file storage, collaborative working and — critically — backup. Their role in backup infrastructure makes them a particularly attractive ransomware target. Encrypting a backup device can significantly undermine an organisation's ability to recover from a broader ransomware attack, effectively removing the safety net that many organisations rely on. The fact that this vulnerability was patched in December 2024 and is still being successfully exploited in November 2026 reflects a persistent and well-documented challenge: patch management for network-attached storage devices, appliances and similar infrastructure is frequently overlooked compared to servers and endpoints. These devices often sit outside standard patch management workflows, are managed by different teams, or are simply forgotten once deployed. Ransomware groups are well aware of this gap and actively target it.

What to review

Any organisation using Synology NAS devices should confirm the current DSM version running on each device and apply available updates as a priority. This is also a useful prompt to review whether NAS devices and similar appliances are included in your standard patch management processes and asset inventory. Backup devices in particular should be assessed for network segmentation — if a NAS used for backups is directly accessible from the same network segment as endpoints and servers, a ransomware attack that compromises the primary environment may also reach the backup. Immutable or air-gapped backup copies, where feasible, provide an additional layer of resilience that is worth reviewing as part of your broader recovery planning.

Source: The Hacker News