Synology warns of ransomware attacks on NAS devices running outdated DSM

Synology is telling customers to update DiskStation Manager, the software that runs its NAS boxes, after ransomware attacks against devices on outdated DSM versions. In a statement reported by The Hacker News on Nov 03, 2026, the Taiwanese vendor said it observed attackers exploiting a vulnerability that was patched in December 2024.

"These attacks aim to encrypt data and extort ransom," the statement said.

That's the whole of what's public. The vendor's statement, as quoted, doesn't name the vulnerability, give a CVE identifier, or say which DSM versions are affected. It also doesn't say how many devices were hit, who was behind the attacks, or whether any ransoms were paid. Nobody has published a technical write-up of the campaign that we've seen.

The pattern is the familiar one: the fix has been out for nearly two years, and the targets are the machines that didn't take it. NAS devices are easy to leave alone, often exposed to the internet for remote access, and frequently hold the backups that ransomware operators most want to encrypt.

For defenders, the first check is the DSM version on every Synology unit you own, including the ones in branch offices and home setups that nobody administers. If a device can't be updated, take it off direct internet exposure. Whether the December 2024 patch covers every affected build is something only Synology's advisory can answer, and it hasn't said.