Internet-exposed Synology NAS hit by ransomware via 18-month-old RCE flaw

A Reddit user reported that their Synology DS918+ NAS was encrypted by ransomware after its web interface was left exposed to the internet and security patches went unapplied for about 18 months. The attack likely exploited the CVE-2024-10441 remote code execution flaw, and the owner's 3-2-1 backup setup appears to have saved the data.

• Attack likely used RCE flaw CVE-2024-10441 disclosed 18 months ago
• NAS web interface was exposed directly to the internet without a VPN
• DSM reports the device is up to date while critical patches need manual installs
• Data survived thanks to a 3-2-1 backup setup