If you are running a Synology NAS — whether in a small office, a branch deployment, or a home lab — the first thing to do today is check which version of DiskStation Manager (DSM) is installed. Synology has issued a warning that attackers are actively exploiting a security flaw fixed back in 2024 to launch ransomware against NAS devices that have not been updated since.
What Synology is saying
According to Security Affairs, which covered the vendor's warning, a security fix released by Synology in 2024 is now at the centre of ongoing ransomware attacks. The company has identified threat actors specifically targeting systems still running outdated versions of DSM, with user files at risk of encryption or theft.
The uncomfortable implication is that the vulnerability itself is not new — the patch has been available since 2024. What has changed is the level of attacker interest: a known, remediated flaw becomes far more dangerous when a meaningful share of the installed base never applies the fix. For administrators, this is a reminder that the window between a vendor advisory and mass exploitation keeps shrinking, and that "we'll patch next maintenance window" is no longer a safe assumption for internet-facing storage.
Why NAS devices are a lucrative target
Network-attached storage is an unusually attractive target for ransomware operators. These devices hold centralised copies of documents, backups, and shared project data — precisely the files organisations most need to recover quickly. They are also frequently exposed to the internet for remote access, and in smaller environments they may be managed by staff without a dedicated security function.
Because NAS appliances run their own operating system and web interface, they also fall outside the routine patch cadence that many teams apply to Windows endpoints. A device commissioned years ago and left untouched can quietly accumulate a backlog of unpatched components. Synology's warning suggests attackers are doing exactly that kind of scanning: looking for DSM instances that never received the 2024 update.
A practical remediation checklist
For administrators responsible for Synology hardware, the following steps are a sensible starting point:
- Check your DSM version now and compare it against the fixed release identified in Synology's advisory. Update immediately if you are behind.
- Enable automatic DSM updates where policy allows, so future fixes are applied without relying on manual scheduling.
- Review exposed services. Disable or restrict any packages, ports, or file-sharing services that are not required, and avoid exposing the DSM login interface directly to the open internet.
- Verify that backups exist and are recoverable — ideally with at least one copy offline or otherwise isolated from the NAS itself, since a compromised device can reach any backup stored alongside it.
- Audit user accounts and permissions, removing dormant accounts and enforcing strong authentication for administrative access.
The wider lesson
This incident is a straightforward case study in patch hygiene rather than a sophisticated zero-day. The fix existed; the risk persisted because deployment lagged. For IT teams and home-lab enthusiasts alike, it is a useful prompt to inventory every NAS and appliance on the network, confirm what firmware level it runs, and bring it current — before an attacker's scanner does the checking for you.
Synology users should consult the company's official advisory for the specific affected and fixed DSM builds relevant to their hardware model.
Source: Security Affairs.
如果你正在使用 Synology NAS——無論是在小型辦公室、分支部署還是家庭實驗室——今天要做的第一件事就是檢查已安裝的 DiskStation Manager（DSM）版本。Synology 已發出警告，指出攻擊者正積極利用一個早在 2024 年已修復的安全漏洞，對一直未更新的 NAS 裝置發動勒索軟件攻擊。
Synology 的說法
根據報導該警告的 Security Affairs 報道，Synology 在 2024 年發布的安全修補程式，目前正成為持續勒索軟件攻擊的核心。該公司已確認有威脅行為者專門針對仍運行過時 DSM 版本的系統，用戶檔案面臨被加密或被竊取的風險。
令人不安的意味在於，這個漏洞本身並不新——修補程式自 2024 年起已可取得。改變的是攻擊者的興趣程度：當相當比例的已安裝裝置從未套用修補時，一個已知且已修復的漏洞會變得危險得多。對系統管理員而言，這是一個提醒：從廠商發布安全公告到漏洞遭大規模利用之間的時間窗口正不斷縮短，而「下個維護時段再修補」對於面向互聯網的儲存設備來說，已不再是一個安全的假設。
為何 NAS 裝置是高回報目標
Network-attached storage 對勒索軟件運營者而言是異常吸引人的目標。這些裝置保存着文件、備份和共享項目資料的集中副本——正是機構最需要快速恢復的檔案。它們也經常為實現遠端訪問而暴露於互聯網上，而在較小的環境中，可能由並無專職保安功能的員工負責管理。
由於 NAS 裝置運行自己的操作系統和 web 界面，它們也不在許多團隊對 Windows 端點所採用的例行修補周期之列。一部多年前啟用後便無人理會的裝置，會靜靜地累積大量未修補的元件。Synology 的警告顯示，攻擊者正進行這類掃描：尋找從未收到 2024 年更新的 DSM 實例。
實用補救清單
對於負責 Synology 硬件的系統管理員，以下步驟是合理的起點：
- 立即檢查你的 DSM 版本，並與 Synology 安全公告中指明的已修復版本對比。如版本落後，請立即更新。
- 在政策允許的情況下啟用 DSM 自動更新，使未來的修補程式得以套用，無需依賴人手排程。
- 檢視已暴露的服務。停用或限制任何不必要的套件、port 或檔案共享服務，並避免將 DSM 登錄界面直接暴露於公開互聯網。
- 確認備份存在且可恢復——理想情況下至少有一份副本離線儲存，或以其他方式與 NAS 本身隔離，因為已被入侵的裝置可以存取任何與它存放在一起的備份。
- 審核用戶帳戶及權限，移除閒置帳戶，並對管理員訪問實施強身份驗證。
更廣泛的教訓
這個事件是一個關於修補衞生的直白案例，而非複雜的 zero-day 攻擊。修補程式早已存在；風險之所以持續，是因為部署滯後。無論對 IT 團隊還是家庭實驗室愛好者而言，這都是一個有用的提示：盤點網絡上的每一個 NAS 和裝置，確認其運行的韌體版本，並使其更新至最新——在攻擊者的掃描器替你檢查之前。
Synology 用戶應查閱該公司的官方安全公告，以獲取與其硬件型號相關的受影響及已修復 DSM build 的具體資訊。
來源：Security Affairs。