Synology DSM flaws exploited in ransomware attacks and Trezor hardware implants detected
TL;DR
Synology DSM users are being targeted by ransomware exploiting unpatched vulnerabilities, and Trezor warns of hardware implants in specific devices. Secure your systems by upgrading Synology DSM immediately and moving funds if you purchased a Trezor Safe 5 from CryptoBilis.
What happened
Multiple high-impact security incidents are currently active. Attackers are using a vulnerability fixed in December 2024 to target unpatched Synology DSM installations with ransomware. Separately, Trezor reported that Trezor Safe 5 devices purchased from the reseller CryptoBilis since March 2026 may contain a hardware implant designed to steal recovery phrases via a cellular module.
In the enterprise space, LLMJacking attacks have generated fraudulent bills exceeding $100,000 per day at some organizations. Meanwhile, the "Greeter" framework used CVE-2024-58351 to target Flowise honeypots for command execution. Finally, Chainalysis disclosed a breach discovered on November 2 that exposed usernames, password hashes, and live tokens, while a Harvard University breach involving 851,000 email addresses has been linked to a ShinyHunters extortion attempt.
Why it matters
The window for defending enterprise software is closing. For SAP, the median time between a security note release and active exploitation has dropped from 489 days in 2021 to just one to three days in 2025/2026. This acceleration, combined with the weaponization of Synology flaws for ransomware, means that unpatched systems are high-priority targets for immediate exploitation.
Who is affected
- Synology DSM users: All versions prior to
7.2.2-72806-1,7.2.1-69057-6,7.2-64570-4,7.1.1-42962-7, or6.2.4-25556-8. - Trezor Safe 5 owners: Specifically those who purchased devices from CryptoBilis since March 2026.
- Chainalysis users: Those whose names, usernames, password hashes, or live tokens were exposed.
- Flowise users: Specifically those vulnerable to
CVE-2024-58351. - Harvard University: Alumni, donors, faculty, staff, and students.
What to do now
- Upgrade Synology DSM to
7.2.2-72806-1,7.2.1-69057-6,7.2-64570-4,7.1.1-42962-7, or6.2.4-25556-8or above. - Transfer all funds to a new wallet with a fresh seed if your Trezor Safe 5 was purchased from CryptoBilis.
- Update Flowise instances to mitigate
CVE-2024-58351. - Monitor Chainalysis accounts for unauthorized access and rotate credentials.
What we don't know yet
- Whether Trezor has officially verified the existence of the hardware implant.
- The specific nature of the Synology flaw currently used in ransomware attacks.
- The full extent of the data exposure at Chainalysis.
Sources
