Synology Urges DSM Updates After Ransomware Attacks Target Outdated Systems

Synology says ransomware attackers are exploiting a vulnerability patched in December 2024. The reviewed Synology notice does not identify the exploited vulnerability; here are fixed DSM thresholds and cited response steps.

Reader ratingRate this article

Loading reader rating…

Privacy-conscious voting uses a signed random browser identifier and a short-lived network hash; the rating tables contain no raw IP-address column.

Reader ratings require JavaScript; the article remains fully readable without it.

One unbranded two-bay NAS between red locked-file icons and an update shield in a dark operations room.
AI-generated editorial illustration of an unbranded NAS between ransomware and update symbols.

Synology says threat actors are exploiting a vulnerability patched in December 2024 to target devices running outdated DSM versions.[1] The company says the attacks aim to encrypt data and demand ransom.[1]

Reporting cutoff: November 2, 2026, 8:23:47 a.m. EST / 13:23:47 UTC.[5] Every current-status and negative-source observation below is limited to the frozen captures available at that cutoff.[5]

Update outdated DSM systems[1]

What Synology has confirmed

Synology urges users running vulnerable DSM versions to update immediately and recommends enabling automatic updates to keep DSM up to date.[1]

The reviewed Synology notice does not identify the exploited vulnerability by CVE.[1][5] Its linked advisory lists three CVEs, but the frozen sources do not establish which one, if any, was used in these ransomware attacks.[1][2][3]

Minimum fixed builds in Synology-SA-24:20

The advisory is marked Critical and Resolved, and its mitigation field says “None.”[2]

DSM 7.2.2

Upgrade to 7.2.2-72806-1 or above.[2]

DSM 7.2.1

Upgrade to 7.2.1-69057-6 or above.[2]

DSM 7.2

Upgrade to 7.2-64570-4 or above.[2]

DSM 7.1

Upgrade to 7.1.1-42962-7 or above.[2]

DSM 6.2

Upgrade to 6.2.4-25556-8 or above.[2]

Caution: these are the advisory’s fixed-release thresholds.[2] Synology’s ransomware notice says to update vulnerable DSM versions immediately and enable automatic updates.[1]

A practical ransomware-response sequence

Practical editorial inference:[4] apply CISA’s general ransomware sequence to a suspected Synology compromise while following Synology’s DSM update instruction; this is not a Synology-specific incident-response procedure.[1][4]

  1. Isolate impacted systems immediately.[4] Determine which systems were affected and isolate them; if individual disconnection is not feasible across several systems or subnets, CISA says to take the network offline at the switch level.[4]
  2. Treat power-down as a last-resort containment step.[4] CISA says to power down only when network isolation or host disconnection is not possible, because power-down prevents preservation of artifacts and potential evidence in volatile memory.[4]
  3. If no initial mitigation actions appear possible:[4] CISA says to take a system image and memory capture from a sample of affected devices and collect relevant logs, malware samples, and indicators.[4] CISA also says to examine detection and prevention systems and logs for evidence of additional systems or earlier-stage malware.[4]
  4. Preserve highly volatile evidence.[4] Preserve evidence that is volatile or has limited retention, including system memory, Windows Security logs, and firewall log buffers, to prevent loss or tampering.[4]
  5. Find precursor malware before rebuilding.[4] CISA cautions that ransomware can obscure post-compromise activity and says precursor malware must be identified before rebuilding from backups to prevent continuing compromise.[4]
  6. Rebuild in service-priority order.[4] Rebuild systems by critical-service priority using pre-configured standard images where possible.[4] Reset passwords and address vulnerabilities and persistence only after the environment has been fully cleaned and rebuilt.[4]
  7. Restore only onto clean systems.[4] Reconnect systems and restore from offline, encrypted backups by critical-service priority, taking care not to reinfect clean systems during recovery.[4]
  8. Apply Synology’s DSM update instruction.[1] Update vulnerable DSM versions immediately and enable automatic updates to keep DSM up to date.[1]

What the linked advisory says

CVE-2024-10441 allows remote attackers to execute arbitrary code via unspecified vectors.[2] CVE-2024-50629 allows remote attackers to read limited files via unspecified vectors.[2] For CVE-2024-10445, the advisory lists CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N and says remote attackers can write limited files via unspecified vectors.[2] These advisory descriptions do not identify the flaw used in the ransomware attacks.[1][2][5]

What remains unknown

  • At the stated cutoff, the reviewed Synology notice does not identify the exploited vulnerability by CVE.[1][5]
  • The reviewed sources do not confirm that CVE-2024-10441, CVE-2024-50629, or CVE-2024-10445 is the exploited vulnerability.[1][2][3][5]
  • BleepingComputer reported user accounts of a read-me3.txt ransom note and a .L0CK3D extension.[3] At the stated cutoff, exact searches of the frozen Synology notice found zero matches for either indicator.[1][5]

Bottom line

Isolate a suspected compromise before recovery.[4] Preserve volatile evidence before a power-down when other isolation methods remain possible.[4] Identify precursor malware, rebuild clean systems, then restore from offline encrypted backups without reinfecting them.[4] Update vulnerable DSM versions immediately and enable automatic updates.[1] Do not assign a specific exploited CVE unless an authoritative source identifies it.[1][2][5]

Sources

  1. Synology ransomware notice (frozen capture reviewed at cutoff).
  2. Synology-SA-24:20 (frozen capture reviewed at cutoff).
  3. BleepingComputer report (frozen capture).
  4. CISA ransomware response checklist (captured at cutoff).
  5. The IT Guys bounded reporting-cutoff and exact-search observations.

Browse Articles

Latest Articles