As reported by SecurityAffairs, Synology disclosed on October 29, 2026 that ransomware operators are actively encrypting NAS devices running outdated DiskStation Manager (DSM) builds. The advisory points back to Synology-SA-24:20, originally published in November 2024 — meaning patches have been available for nearly two years, yet enough unpatched devices remain to sustain a profitable extortion campaign.
This incident is less a story about novel exploitation and more a case study in the systemic patch-management failures that plague edge and IoT-adjacent infrastructure. NAS appliances are frequently deployed outside formal IT asset management programs, accumulate in network closets for years, and receive minimal post-deployment maintenance. Threat actors understand this economics: the longer a high-severity CVE circulates, the more reliable it becomes as a commodity intrusion vector.
Vulnerability Breakdown
While Synology has not confirmed which specific CVE the ransomware actors are leveraging, the advisory covers three distinct issues. Given the campaign's goal of file encryption and extortion, the CVSS 9.1 CVE-2024-10441 — enabling unauthenticated remote code execution through the system plugin daemon — is the most probable primary vector.
| CVE | CVSS | Severity | Component | Impact |
|---|---|---|---|---|
| CVE-2024-10441 | 9.8 | Critical | System plugin daemon | Unauthenticated remote code execution |
| CVE-2024-50629 | 5.3 | Medium | DSM webapi | Remote file read (limited) |
| CVE-2024-10445 | 4.3 | Medium | Update subsystem | Adjacent-network file write (limited) |
Why NAS Devices Are High-Value Ransomware Targets
Threat actors targeting storage appliances aren't just after files — they're after recovery infrastructure. NAS devices frequently hold backup repositories, shared operational documents, and archival data that organizations rely on for restoration after an incident. Encrypting the primary storage and the backups in a single operation is the ransomware playbook's most devastating move, and NAS appliances that combine both functions in one exposed surface present an ideal target.
Devices patched in December 2024 being exploited in November 2026 should eliminate any remaining belief that 'we'll get to it' is an acceptable patch strategy for internet-exposed infrastructure.
Who Is Most at Risk
- SMBs and distributed offices with NAS devices managed informally or by non-security personnel
- Organizations running DSM 6.2, which is approaching or past its end-of-support lifecycle and may not receive further security updates
- Environments where NAS appliances are directly internet-exposed rather than behind VPN or zero-trust access controls
- Backup architectures where the NAS is the backup target, creating a single point of encryption failure
Shield53 Recommendations
Immediate Actions:
- Inventory and version-check every Synology NAS in your environment. Compare installed DSM build numbers against the minimum fixed releases: DSM 7.2.2 (72806-1+), 7.2.1 (69057-6+), 7.2 (64570-4+), 7.1.1 (42962-7+), and 6.2.4 (25556-8+).
- Apply DSM updates immediately on any device below the fixed threshold. If immediate patching isn't possible, take the device offline or isolate it from internet-facing network segments.
- Remove internet exposure for all NAS management interfaces. DSM should not be reachable on ports 5000/5001 from the open internet. Enforce VPN or zero-trust network access for remote administration.
- Implement offline or immutable backups that a compromised NAS cannot reach. If your only backup lives on the device being encrypted, you don't have a backup — you have a liability.
- Review DSM admin logs for signs of prior exploitation: unexpected SSH access, new service accounts, or bulk file modification timestamps that don't match legitimate user activity.
- Disable unused services on the DSM control panel and enforce strong, unique admin credentials with two-factor authentication.
Broader guidance: Treat every network-attached storage appliance as a server requiring the same lifecycle governance as your datacenter infrastructure — not as a set-and-forget peripheral. The two-year gap between patch availability and active exploitation demonstrates that the risk isn't in the vulnerability; it's in the persistence of unmanaged exposure.
