TZUTC: -0500
MSGID: 1247.consprcy@1:2320/105 2cdfa070
PID: Synchronet 3.21a-Linux master/123f2d28a Jul 12 2025 GCC 12.2.0
TID: SBBSecho 3.28-Linux master/123f2d28a Jul 12 2025 GCC 12.2.0
BBSID: CAPCITY2
CHRS: ASCII 1
FORMAT: flowed
Ransomware gang attacking NAS devices taken down in major police operation

Date:
Fri, 18 Jul 2025 10:28:08 +0000

Description:
A 44-year-old man was arrested in Romania, and someone was caught in the act.

FULL STORY

A 44-year-old Romanian national has been arrested during a law enforcement
operation to dismantle a ransomware campaign called Diskstation. 

Diskstation usually targets Synology Network-Attached Storage ( NAS) devices 
, often used in an enterprise environment for centralized file storage and
sharing, data backup and recovery, and general content hosting. The group was
first spotted in 2021, and has since used different names, such as 
DiskStation Security, Quick Security, LegendaryDisk Security, 7even Security,
and Umbrella Security. 

Police received a series of complaints filed by numerous companies operating
in Lombardy, who suffered data encryption and were thus unable to operate
unless they  paid a ransom in exchange for the decryption key.

Targeting Synology devices

Among the targets were film production organizations, event organizations, 
and non-profits, all active at an international level in the field of civil
rights protection and charity events. 

The polices investigation, which included analyzing both the encrypted 
devices and the blockchain (since the ransom demands were paid in
cryptocurrency), led the detectives to France and Romania, and resulted in
Operation Elicius, coordinated by EUROPOL. 

Several subjects were identified as part of the Diskstation group, all of
Romanian nationality. In June 2024, the police raided the homes of multiple
suspects in Bucharest and according to the announcement, even caught one
person "in the act of committing a crime. 

The 44-year-old that was arrested is now detained, under the suspicion of
abusive access to a computer or telematic system, and extortion. 

Diskstations shenanigans werent widely reported in the tech media. The name 
is most commonly associated with Synologys NAS product line which has been
targeted by ransomware cybercriminals in the past. 

This particular group reportedly demanded ransom payments between $10,000 and
hundreds of thousands of dollars. 

 Via BleepingComputer

======================================================================
Link to news story:
https://www.techradar.com/pro/security/ransomware-gang-attacking-nas-devices-t
aken-down-in-major-police-operation

$$
--- SBBSecho 3.28-Linux
 * Origin: capitolcityonline.net * Telnet/SSH:2022/HTTP (1:2320/105)
SEEN-BY: 105/81 106/201 128/187 129/14 305 153/7715 154/110 218/700
SEEN-BY: 226/30 227/114 229/110 111 206 300 307 317 400 426 428 664
SEEN-BY: 229/700 705 266/512 291/111 320/219 322/757 342/200 396/45
SEEN-BY: 460/58 712/848 902/26 2320/0 105 304 3634/12 5075/35
PATH: 2320/105 229/426