Ransomware operators are encrypting files on Synology network-attached storage (NAS) devices and demanding payment, Hong Kong's computer emergency response team warned in an alert published on November 2. Citing Synology, HKCERT says the attacks exploit a vulnerability the vendor patched in December 2024 and are aimed at devices still running end-of-life versions of DiskStation Manager (DSM), the operating system on Synology's storage boxes.
That makes this a story about old, unsupported hardware rather than a fresh zero-day. Neither the alert nor the Synology guidance it summarises names the vulnerability or the ransomware family, and Synology's own advisory carries the detail. No group is attributed.
PHP2Shell is a separate problem, for now
Synology has separately released fixes for the PHP2Shell vulnerabilities in systems running PHP-dependent packages, and has extended those fixes to older DSM releases. The vendor has not confirmed whether PHP2Shell played any part in the ransomware attacks, and HKCERT does not link the two. PHP2Shell has been under active exploitation since late October, as we reported when CISA listed the flaws as exploited in the wild.
HKCERT stresses that the PHP updates do not return end-of-life DSM versions to full support. They are a stopgap for systems that cannot move.
Upgrade DSM, then update PHP packages
- Upgrade to the latest DSM version that both the device and Synology still support. If the hardware cannot run a supported version, plan to replace it.
- Install the PHP security updates through Package Center. Updates are available for DSM 7.4, 7.3, 7.2, 7.1, 7.0 and 6.2; MailStation needs a separate manual update.
- On DSM versions earlier than 6.2, temporarily disable the affected packages as Synology recommends, then upgrade.
- Do not expose NAS management interfaces directly to the internet, and switch off unnecessary services and port forwarding.
- Keep offline or immutable backups and test that they restore.
If files are already encrypted
HKCERT advises disconnecting the NAS from the network at once and pausing any sync or backup jobs, so the damage does not spread to other copies. Keep ransom notes, encrypted samples and system and access logs, and avoid resetting, formatting or needlessly restarting the device. Restore from clean backups only after the entry point is found and fixed. Installing updates will not decrypt files that are already locked, and paying the ransom does not guarantee their return.
The pattern is a familiar one for storage appliances: a NAS that still works is easy to forget, long after the vendor has stopped patching it. Earlier this year two other critical Synology flaws let unauthenticated attackers write files, which is a reminder of how much depends on these boxes staying current.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.