GoKawiilSynology NAS ransomware traced to 18-month-old unpatched CVE-2024-10441 flaw
A Reddit user running a Synology DS918+ NAS had files encrypted by ransomware after leaving the device's web interface exposed directly to the internet and roughly 18 months behind on security patches. Forensic analysis of logs and system files, after moving the drives to a Proxmox machine, pointed to exploitation of CVE-2024-10441, a remote code execution vulnerability Synology disclosed a year and a half earlier. The user avoided data loss thanks to a 3-2-1 backup setup.