Qué ocurrió
Synology warned customers that threat actors are using a vulnerability patched in December 2024 (addressing CVE‑2024‑10441, CVE‑2024‑50629, CVE‑2024‑10445) to compromise NAS devices running older DSM versions. The attackers gain code execution, read/write files, and then encrypt data, appending a .L0CK3D extension and leaving a ransom note demanding payment for a decryption tool. Synology’s advisory urges immediate upgrade to the latest DSM releases and enabling automatic updates, as well as blocking external access to the management web interface.
Por qué es importante para la confianza y el cumplimiento
- The attack underscores the importance of a documented vulnerability‑management control that provides evidence of timely patching across all assets, a control objective that aligns with multiple frameworks.
- Demonstrate timely patch deployment evidence for audit and compliance reviews.
- Show continuous monitoring of firmware versions to satisfy control‑mapping requirements.
Who is affected
Organizations using Synology NAS appliances across technology, healthcare, education, and SMB sectors
Recommended actions
- Inventory DSM versions on all Synology devices.
- Upgrade to the latest DSM release (7.2.2‑72806‑1 or newer).
- Enable automatic DSM updates.
- Block internet access to the management web UI.
- Document the patch‑management process and retain logs as audit evidence.