Ransomware Attack on Exposed Synology NAS Due to Outdated Security

• •Ransomware encrypted files on a Synology DS918+ due to outdated security patches.
• •Attackers exploited CVE-2024-10441, a critical remote code execution vulnerability.
• •Synology's update process may mislead users about the necessity of manual updates.

A ransomware attack has encrypted files on a Synology DS918+ NAS owned by user NakamuraHwang, who had not updated the device for 18 months. The NAS was exposed to the internet, making it vulnerable to exploitation. Investigations indicated that the attackers likely exploited the CVE-2024-10441 remote code execution vulnerability, disclosed in March 2025. Hwang's 3-2-1 backup strategy helped prevent data loss. The Synology DSM operating system allows disks to be mounted on other systems, facilitating forensic analysis. While Synology issued an advisory regarding the vulnerability, the update process may have contributed to the incident, as critical updates required manual installation. The user was unaware of the need for these updates due to the misleading interface reporting the device as up to date. Synology lacks a direct notification system for critical vulnerabilities, which could leave ordinary users uninformed about security risks.