```
Synology is urging customers to bring the DiskStation Manager (DSM) software on their Network Attached Storage devices up to date, after observing ransomware attacks that leverage a vulnerability already fixed in December 2024 — a reminder that the attackers' advantage here is not a fresh zero-day, but slow patching.
According to The Hacker News, the Taiwanese storage vendor said threat actors are targeting devices still running outdated DSM builds by exploiting the previously patched flaw. "These attacks aim to encrypt data and extort ransom," Synology said in a statement, framing the campaign squarely as a financially motivated extortion operation rather than opportunistic sabotage. The report itself is light on technical detail: it does not name a CVE identifier, define the affected DSM version range, or estimate how many devices have been hit, and we were unable to independently fill those gaps from the material cited.
The timeline is the story. A fix for this weakness shipped more than a year ago, which means any device compromised now was, by definition, running software its owner had not updated since at least December 2024. In that sense the incident is less a vendor defect than a case study in update hygiene: the patch existed, and the window between disclosure and exploitation was wide open. For an industry accustomed to racing against zero-day flaws, this is the more common and arguably more avoidable failure mode — the automation that scans the internet for exposed services has long since folded older, publicized vulnerabilities into its playbook, so unpatched boxes do not stay quietly unpatched for long.
That matters acutely for NAS hardware, which has become an unusually attractive extortion target. Unlike a single laptop or a scattered set of endpoints, a NAS typically functions as a single, high-value target holding everything at once: production documents, family photos, virtual machine images, and — critically — the backups that would otherwise be the recovery path. Consolidating primary data and its backups into one internet-reachable appliance creates exactly the kind of single point of failure ransomware crews look for. Encrypt it, and the victim loses both the data and the means to restore it, which is what strengthens the extortion leverage. Home users and small businesses are disproportionately exposed here, because a NAS is often their only real storage infrastructure and is frequently port-forwarded or cloud-connected for remote access.
The practical response for administrators and home lab operators breaks down into four moves:
- Update DSM now. Check the running version against Synology's current guidance and apply the latest release through the control panel. Do not assume automatic update settings were enabled — verify them.
- Review exposure and hardening. Audit port-forwarding rules, disable unused services, enforce strong credentials, and consider restricting administrative interfaces to a VPN or local network only.
- Verify the 3-2-1 backup rule. Ensure at least one copy of critical data lives off the NAS itself — on separate media, a different physical site, or immutable cloud storage — so device encryption cannot take the recovery path down with it.
- Check logs for prior compromise. Review access, package, and authentication logs for unexpected activity, because attackers who exploited a long-patched flaw may already have had time to establish persistence before the update was ever applied.
The broader lesson is that defenders do not need to lose the race against novel vulnerabilities to end up breached; losing the slower race against known ones is enough. For NAS owners specifically, the irony is pointed: the appliance bought to safeguard data can become the very asset attackers encrypt to demand payment. Confirming that DSM is current, that the box is not unnecessarily exposed, and that a genuine off-device backup exists remains the cheapest insurance available — and in this campaign, it is precisely the gap the attackers are exploiting.
```
Synology 呼籲客戶盡快將 Network Attached Storage（NAS）裝置上的 DiskStation Manager（DSM）軟件更新至最新版本，此前該公司發現有勒索軟件攻擊利用一項早在 2024 年 12 月已修補的漏洞——這提醒業界，攻擊者在此的優勢並非新鮮的 zero-day 漏洞，而是緩慢的修補部署。
據 The Hacker News 報導，這家台灣存儲設備廠商表示，威脅行為者正透過利用早前已修補的漏洞，攻擊仍在運行過時 DSM 版本的裝置。Synology 在聲明中表示：「這些攻擊旨在加密數據並勒索贖金。」該公司明確將此行動定性為以經濟利益為動機的勒索行動，而非機會性的破壞行為。報道本身技術細節有限：未有指明 CVE 編號、界定受影響的 DSM 版本範圍，亦未估計有多少裝置受影響，而我們亦無法從所引用的資料中獨立補充這些資訊。
關鍵在於時間線。針對此弱點的修復方案已推出超過一年，這意味著目前被入侵的裝置，按定義而言，其擁有者自至少 2024 年 12 月以來從未更新過軟件。就此而言，這次事件與其說是廠商缺陷，不如說是一堂關於更新衞生的案例研究：修補程式早已存在，而從漏洞披露到被利用之間的窗口期一直大開。對於一個習慣與 zero-day 弱點賽跑的行業來說，這才是更常見、亦可說更可避免的失敗模式——掃描互聯網上暴露服務的自動化系統，早已將較舊且已公開披露的漏洞納入其攻擊劇本之中，因此未套用修補程式的機器並不會安靜地維持未修補狀態太久。
這對 NAS 硬件尤其重要，因為它已成為異常吸引勒索者的目標。有別於一部筆記本電腦或分散的終端裝置，NAS 通常作為一個單一、高價值的目標，同時存放所有內容：生產文件、家庭照片、虛擬機映像，以及——至關重要的——原本應作為恢復途徑的備份。將主要數據及其備份整合到一台可經互聯網訪問的設備上，正好製造了勒索軟件團伙所尋找的單點故障。一旦加密，受害者便同時失去數據及恢復數據的手段，這正是加強勒索籌碼的關鍵。家庭用戶和小型企業在此尤其暴露風險，因為 NAS 往往是他們唯一的真正存儲基礎設施，而且經常透過 port forwarding 或雲端連接以作遠程訪問。
管理員及家庭實驗室（home lab）營運者的實際應對措施可分為四個步驟：
- 立即更新 DSM。 將現行運行版本與 Synology 最新指引作對比，並透過控制面板套用最新版本。不要假設自動更新設定已啟用——必須自行確認。
- 檢視暴露程度及加固情況。 審查 port forwarding 規則、停用未使用的服務、強制使用強密碼，並考慮將管理介面限制為僅可透過 VPN 或本地網絡訪問。
- 確認 3-2-1 備份規則。 確保至少有一份重要數據副本存放於 NAS 以外——載於獨立介質、不同實體地點，或不可變（immutable）雲端存儲——使裝置加密無法同時摧毁恢復途徑。
- 檢查日誌有否先前入侵跡象。 審查訪問、軟件套件及認證日誌有否異常活動，因為利用早前已修補漏洞的攻擊者，可能在更新真正套用之前已建立持久化機制。
更廣泛的教訓是：防守方並不需要在與新穎漏洞的競賽中落敗才會被攻破——輸掉與已知漏洞之間較慢的那場比賽已綽綽有餘。對 NAS 用戶而言，諷刺之處十分尖銳：購入來保護數據的設備，竟可能成為攻擊者加密以索取付款的資產。確認 DSM 為最新版本、機器沒有不必要的暴露，以及確實存在設備以外的真正備份，仍然是現時最便宜的保障——而在這次攻擊行動中，這正是攻擊者所利用的缺口。