Act
active
Synology NAS Ransomware Attacks Exploit Dec 2024 DSM Vulnerability
- Engineer — Act: Active ransomware is encrypting data on Synology NAS devices running unpatched DSM; update all DiskStation Manager installations to the December 2024 patched release immediately and audit any internet-exposed NAS devices for signs of compromise.
- SOC/IR — Act: Ongoing ransomware campaign targeting unpatched Synology NAS — inventory all Synology devices in the estate, flag those running pre-December 2024 DSM as high-risk, and hunt for anomalous file encryption or unusual outbound traffic from NAS hosts since threat actors may already be in unpatched devices.
- Leader — Plan: Active ransomware targeting a widely deployed NAS platform where a patch has been available since December 2024; confirm engineering has remediated all Synology devices this week and verify backup integrity has not been affected, since NAS devices often serve as backup targets.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.