Ransomware Attack Exploits CVE-2024-10441 on Synology DS918+ NAS
A ransomware attack exploited CVE-2024-10441 on a Synology DS918+ NAS, encrypting files. The device was unpatched for 18 months and exposed online.
OffSet7 Newsroom · Reviewed by an OffSet7 analyst · AI-assisted
What happened
Ransomware attack encrypted files on a Synology DS918+ NAS.
Who is affected
Synology DS918+ NAS devices.
Exploited
The attacker exploited CVE-2024-10441, a remote code execution vulnerability.
What to do
Synology published an advisory regarding the vulnerability.
A ransomware attack has encrypted files on a Synology DS918+ NAS device by exploiting CVE-2024-10441, a remote code execution vulnerability. The device had been exposed to the internet and had not received security patches for approximately 18 months, according to sources.
The attack is part of a larger campaign affecting multiple Synology NAS devices. The ransomware encrypts files with the .L0CK3D extension and leaves a ransom note. It uses RSA-4096 encryption combined with AES or ChaCha20, and no general free decryption tool is currently available.
Despite the encryption, the user avoided data loss by maintaining a 3-2-1 backup setup. The NAS was inspected by connecting its disks to a Proxmox machine. Synology's DSM interface had falsely reported that the device was up to date.
Synology has published an advisory regarding the CVE-2024-10441 vulnerability. However, the company lacks a direct method to alert customers about critical vulnerabilities. The ransomware is not primarily spreading through SMB shares from infected Windows machines.
