In an October 29 notice, Synology says attackers are exploiting vulnerabilities patched by 2024 to encrypt data on devices running outdated DSM and demand ransom. The linked advisory lists minimum fixed releases of DSM 7.2.2-72806 Update 1, 7.2.1-69057 Update 6, 7.2-64570 Update 4, 7.1.1-42962 Update 7, and 6.2.4-25556 Update 8. It covers remote-code-execution and file-access flaws and lists no separate mitigation. Users should install the latest supported update for their model and branch and enable automatic updates; the notice does not mean every NAS is infected.
Back to Tech
Synology urges DSM updates after ransomware targets outdated versions
This is exploitation of already patched flaws, not a newly disclosed zero-day; check the release supported by your NAS model.