Synology NAS Ransomware Attacks Exploit Unpatched Vulnerabilities Worldwide

Network-attached storage devices have quietly become one of the most attractive targets for ransomware operators in late 2026. Synology, one of the world’s leading NAS manufacturers, disclosed on October 29 that threat actors are actively exploiting vulnerabilities in systems running outdated versions of DiskStation Manager (DSM), the operating system that powers millions of its devices across homes and enterprises. The attacks aim to encrypt data and extort ransom from users who delayed installing security updates that were available for nearly a year.

The Vulnerability Behind the Attacks

Synology’s investigation traced the active exploitation to a security advisory originally published in November 2024, with patches rolling out through December of that year. The advisory, designated Synology-SA-24:20, documents three distinct vulnerabilities affecting DSM across multiple software branches. The most severe of these, CVE-2024-10441, carries a CVSS score of 9.8 out of 10, placing it in the critical severity category.

This particular flaw resides in the system plugin daemon and allows an unauthenticated remote attacker to execute arbitrary code on a vulnerable device. In practical terms, this means an attacker can take full control of a NAS unit exposed to the internet without needing any credentials whatsoever. The second vulnerability, CVE-2024-50629, rated at 5.3 on the CVSS scale, affects the DSM webapi component and permits remote attackers to read limited files from the device. The third issue, CVE-2024-10445, rated at 4.3, involves improper certificate validation in the update mechanism that could allow an attacker in an adjacent network position to write limited files to the system.

While Synology released fixes for all three vulnerabilities months ago, the company’s disclosure confirms what cybersecurity professionals have long warned: a patch is only effective if it is actually installed. Devices left without security updates remain fully exposed long after the vendor has made a fix available, creating a persistent attack surface that ransomware groups are increasingly learning to monetize.

Why NAS Devices Are Prime Ransomware Targets

Network-attached storage devices occupy a unique position in both consumer and enterprise IT environments. They centralize large volumes of valuable data, including documents, photographs, financial records, backups, and business-critical files. Many organizations use NAS devices as primary backup repositories, which makes them especially devastating targets for ransomware. When attackers encrypt both production systems and the backups stored on a NAS, victims lose their recovery options and face greater pressure to pay.

Several factors make NAS devices particularly vulnerable to ransomware campaigns:

• Internet exposure: Many NAS devices are directly accessible from the public internet, either through port forwarding or misconfigured remote access settings, making them discoverable by automated scanning tools.
• Inconsistent patching: Unlike managed enterprise servers, NAS devices in small businesses and home environments often lack dedicated IT oversight, leading to delayed or skipped updates.
• Centralized data storage: A single compromised NAS can give attackers access to terabytes of sensitive data, maximizing the impact of a single successful intrusion.
• Backup role: When NAS devices serve as backup destinations, encrypting them eliminates the victim’s ability to restore without paying, significantly increasing ransom payment pressure.
• Default configurations: Many devices ship with default credentials or services enabled that users never change or disable, creating easy entry points for attackers.

The Broader Ransomware Landscape in Late 2026

The Synology attacks are unfolding against a backdrop of intensifying global ransomware activity. According to threat intelligence tracking from Ransom-DB, the rolling 30-day window through early November captured 1,026 confirmed enterprise victims across 83 active ransomware groups. This volume aligns with the sustained pressure observed throughout the autumn, with August recording 1,075 attacks and October closing at 1,062.

Two groups dominated the extortion landscape during this period. The_Gentlemen claimed 125 victims while Qilin recorded 122, together accounting for nearly a quarter of all observed breaches globally. The United States bore the heaviest burden, representing 460 incidents or 44.8 percent of the total, followed by Germany with 54 and Canada with 34. Perhaps most alarmingly, the threat actor n0n surged 372 percent, jumping from 18 to 85 monthly victims, demonstrating how quickly emerging groups can scale their operations.

Kaspersky’s 2026 ransomware analysis revealed several parallel trends that contextualize the NAS attacks. Ransomware groups are increasingly prioritizing the neutralization of endpoint defenses before executing payloads, using tools known as EDR killers that exploit signed drivers through a technique called Bring Your Own Vulnerable Driver (BYOVD). Additionally, as ransom payment rates dropped to 28 percent in 2025, some groups have pivoted to encryptionless extortion, focusing purely on data theft and the threat of public disclosure rather than file encryption.

How Attackers Exploit Unpatched NAS Systems

The attack chain against unpatched Synology devices typically follows a predictable but devastating sequence. Attackers begin by scanning the internet for devices running vulnerable DSM versions, using readily available tools that can identify exposed systems within hours. Once a vulnerable device is identified, attackers exploit CVE-2024-10441 to gain remote code execution without authentication.

With code execution access, attackers can install ransomware payloads that systematically encrypt files stored on the device. In many observed cases, attackers also attempt to delete volume snapshots and backup jobs before deploying the encryption payload, eliminating potential recovery paths. Some campaigns also exfiltrate sensitive data before encryption, enabling double extortion tactics where victims face both the loss of access to their files and the threat of public data disclosure.

Defending NAS Devices Against Ransomware

Protecting network-attached storage from ransomware requires a multi-layered approach that addresses both technical vulnerabilities and operational practices. Organizations and individuals running NAS devices should implement the following defensive measures:

• Install updates immediately: Check for DSM updates regularly and install security patches as soon as they become available. Do not delay updates, especially for advisories rated critical or high severity.
• Disable direct internet exposure: NAS devices should never be directly accessible from the public internet. Use a VPN or zero trust network access solution for remote connectivity instead of port forwarding.
• Enable firewall rules: Configure the built-in DSM firewall to restrict access to known IP ranges and block all unauthorized connection attempts.
• Implement multi-factor authentication: Enable two-step verification for all DSM accounts, especially administrative accounts, to prevent credential-based attacks.
• Maintain offline backups: Follow the 3-2-1 backup rule by keeping at least three copies of data, on two different media types, with one copy stored offline or in an immutable cloud location that ransomware cannot reach.
• Audit user permissions: Apply the principle of least privilege by granting users only the access rights they need, and review permissions periodically to remove unnecessary privileges.
• Monitor for anomalous activity: Enable DSM logging and alerting to detect unusual login attempts, large file modifications, or sudden spikes in disk activity that may indicate an attack in progress.

The Patching Imperative

The Synology attacks underscore a fundamental truth in cybersecurity that remains as relevant as ever: the gap between vulnerability disclosure and patch deployment is where attackers find their opportunity. When a vendor releases a fix, the clock starts ticking for every affected device. Systems that remain unpatched become increasingly vulnerable over time as exploit techniques are shared, automated, and incorporated into ransomware-as-a-service platforms.

The NCSC’s 2026 annual review reinforces this concern. The UK cyber agency noted that the most successful attacks still rely on familiar methods, with 88 percent of incidents against large organizations starting through one of four vectors: exploiting public-facing applications, phishing, misuse of valid accounts, and exploiting remote services. Unpatched NAS devices sitting on the internet fall squarely into the first category.

As ransomware groups continue to evolve their tactics, incorporating AI-assisted attack techniques and expanding their target surface to include previously overlooked devices like NAS systems, the importance of timely patching and proper network architecture has never been clearer. The fix for CVE-2024-10441 has been available since December 2024. For any organization still running an unpatched Synology device, the time to act is now, before attackers find it first.

---

Edited by Palawan @QUE.COM
Website: https://QUE.COM Intelligence
Sponsored by: https://MAJ.COM AI Autonomous