DSM Targeted in Ransomware Attacks Exploiting Patched DSM Flaw
A security flaw has come to light in DSM, with enough detail now public for defenders to act on it.
A security flaw has come to light in DSM, with enough detail now public for defenders to act on it.
This requires local or already-authenticated access to reach.
Synology is urging customers to update the DiskStation Manager (DSM) software powering its Network Attached Storage (NAS) devices following ransomware attacks.
The Taiwanese vendor said it observed threat actors exploiting a vulnerability patched in December 2024 to target devices running outdated versions of DSM.
While Synology did not disclose the exact security flaw that's being exploited in these attacks, the company linked to a November 2024 security advisory that listed three vulnerabilities - The development comes amid reports from customers that their Synology devices have been hit by C3RB3R ransomware, which has been observed locking users' files with a extension.
Then, in August 2021, Synology warned of brute-force attacks driven by a malware family called StealthWorker that led to ransomware infections.
Anyone running DSM of DSM is exposed, specifically wherever DSM is actually deployed rather than just licensed or installed somewhere unused.
This is not the first time NAS devices have been the target of ransomware attacks.
In 2019, NAS devices manufactured by Taiwan-based QNAP Systems were compromised by QNAPCrypt (aka eCh0raix) ransomware.
What an attacker actually gains: the advisory describes a real security impact once the vulnerable path is reached.
This is tracked as CVE-2021-28799 -- use that identifier when checking vendor guidance or scanner results.
The affected versions are of DSM, so that's the range to check against your own deployment.
That same month, Palo Alto Networks Unit 42 also disclosed details of an eCh0raix variant targeting NAS devices from both QNAP and Synology by leveraging vulnerabilities like CVE-2021-28799 or brute-force their way in by making use of commonly used administrative credentials.
Confirm whether DSM of DSM is present anywhere in your asset and software inventory.
No exploitation has been reported yet, but that status can change, so keep watching vendor guidance while you remediate.
What happened
A security flaw has been identified in DSM, with sufficient detail now available for defenders to take action.
This flaw requires local or already-authenticated access to be exploited.
Synology is urging customers to update the DiskStation Manager (DSM) software that powers its Network Attached Storage (NAS) devices in light of recent ransomware attacks.
What changed
The Taiwanese vendor reported observing threat actors exploiting a vulnerability that was patched in December 2024 to target devices running outdated versions of DSM.
While Synology did not disclose the specific security flaw being exploited in these attacks, the company referenced a November 2024 security advisory listing three vulnerabilities.
This development follows reports from customers indicating that their Synology devices have been compromised by C3RB3R ransomware, which has been noted for locking users' files with a specific extension.
In August 2021, Synology also warned of brute-force attacks driven by a malware family called StealthWorker, which resulted in ransomware infections.
Who is affected
Anyone running DSM of DSM is at risk, particularly in environments where DSM is actively deployed rather than just licensed or installed unused.
This is not the first instance of NAS devices being targeted by ransomware attacks.
In 2019, NAS devices manufactured by Taiwan-based QNAP Systems were compromised by QNAPCrypt (also known as eCh0raix) ransomware.
Why it matters
The advisory highlights the tangible security impact an attacker can achieve once the vulnerable path is accessed.
Technical details
This issue is tracked as CVE-2021-28799; use this identifier when reviewing vendor guidance or scanner results.
The affected versions are of DSM, so check your deployment against this range.
That same month, Palo Alto Networks Unit 42 disclosed details of an eCh0raix variant targeting NAS devices from both QNAP and Synology by exploiting vulnerabilities such as CVE-2021-28799 or utilizing commonly used administrative credentials to perform brute-force attacks.
What security teams should do
Verify whether DSM of DSM is present in your asset and software inventory.
While no exploitation has been reported yet, this status may change, so continue to monitor vendor guidance as you work on remediation.