Synology is urging customers to update the DiskStation Manager (DSM) software powering its Network Attached Storage (NAS) devices following ransomware attacks.

The Taiwanese vendor said it observed threat actors exploiting a vulnerability patched in December 2024 to target devices running outdated versions of DSM.

"These attacks aim to encrypt data and extort ransom," it said in a statement released last week.

While Synology did not disclose the exact security flaw that's being exploited in these attacks, the company linked to a November 2024 security advisory that listed three vulnerabilities -

The development comes amid reports from customers that their Synology devices have been hit by C3RB3R ransomware, which has been observed locking users' files with a ".L0CK3D" extension.

This is not the first time NAS devices have been the target of ransomware attacks. In 2019, NAS devices manufactured by Taiwan-based QNAP Systems were compromised by QNAPCrypt (aka eCh0raix) ransomware.

Then, in August 2021, Synology warned of brute-force attacks driven by a malware family called StealthWorker that led to ransomware infections.

"These attacks leverage a number of already infected devices to try and guess common administrative credentials, and if successful, will access the system to install its malicious payload, which may include ransomware," it said at the time. "Devices infected may carry out additional attacks on other Linux-based devices, including Synology NAS."

That same month, Palo Alto Networks Unit 42 also disclosed details of an eCh0raix variant targeting NAS devices from both QNAP and Synology by leveraging vulnerabilities like CVE-2021-28799 or brute-force their way in by making use of commonly used administrative credentials.

Source link