Synology is warning that attackers are breaking into its network-attached storage (NAS) devices and encrypting them with C3RB3R ransomware. In a notice dated October 29 (per WindowsForum), the company said it has seen threat actors "exploiting a vulnerability patched in December 2024" on devices running outdated versions of its DSM operating system, and it urged everyone on a vulnerable version to update "immediately," according to BleepingComputer.
Why it matters: a NAS is often where small offices and home users keep their backups. Techaeris reports that this malware encrypts backups stored on the same device too, and no free decryptor exists. And Shadowserver tracks more than 380,000 Synology NAS devices reachable from the internet, BleepingComputer notes, though that figure doesn't say how many are patched.
What we know about the attack
| Detail | What's been reported |
|---|---|
| Synology's explanation | A DSM flaw patched in December 2024; the notice points to advisory SA-24:20 (BleepingComputer, WindowsForum) |
| CVEs in SA-24:20 | CVE-2024-10441 (code execution), CVE-2024-50629 (file read), CVE-2024-10445 (file write) |
| Encrypted files | Renamed with a .L0CK3D extension; ransom note read-me3.txt in each folder |
| Ransom | Starts at 0.036960 bitcoin (about $2,952) and doubles after five days, per Techaeris |
| Encryption | ChaCha8 per file, with keys wrapped by RSA-2048, per Techaeris |
BleepingComputer says Synology hasn't publicly named which of the three SA-24:20 bugs is being used; Techaeris reports that Synology attributes the attacks to CVE-2024-10441, rated CVSS 9.8.
The catch: not everyone agrees on the way in
Two outlets report that Chinese security firm 360 attributes the campaign to different, newer bugs — CVE-2026-13639 and CVE-2026-13684, both CVSS 9.8 and fixed in Synology advisory SA-26:13 on September 18, 2026. Techaeris says Synology rejects that as the entry point. WindowsForum also cites a report from a response team called Solar of a victim running a recent DSM 7.4.1 build, which it describes as unconfirmed and not a clean fit with either account. Both outlets say add-on packages, containers or stolen credentials haven't been ruled out.
That disagreement has a practical consequence. BleepingComputer's table lists the minimum builds that contain the 2024 fix — for example 7.2.2-72806-1. Techaeris points out that a build like that includes the 2024 patch but not the September 2026 one. If you only clear the 2024 bar, you may still be exposed to the bugs 360 blames.
What to do now
- Check your exact build. In DSM, open Control Panel > Update & Restore and read the full build string, including the last digit.
- Install the newest update for your branch. Techaeris lists these as fixed builds for the September 2026 advisory: DSM 7.4-90075, 7.3.2-86009-4, 7.2.2-72806-9 and 7.2.1-69057-12. Newer is fine.
- Update every package in Package Center, and turn on automatic updates — Synology itself recommends the latter.
- Take the login page off the internet. BleepingComputer advises blocking internet access to the management interface. WindowsForum suggests a VPN or Synology's relay service instead of port forwarding.
- Look for signs of tampering. Techaeris summarizes Synology's checklist: run Security Advisor, look in Task Scheduler for scripts you didn't create and in User & Group for admin accounts you didn't add. If you find either, contact Synology Support rather than trying to clean up yourself.
- Get a backup off the box. Use Hyper Backup or Snapshot Replication to an off-site or isolated target, and confirm the jobs actually finish.
If a device is already hit, WindowsForum advises disconnecting it from the internet before restarting it, keeping the encrypted files and ransom note, and checking snapshots before doing anything to the storage.
Separately, Synology also recommends patching the PHP2Shell bugs in DSM, though it says they aren't how C3RB3R gets in. We covered those in our PHP2Shell patch guide.
What to watch
Whether Synology publishes indicators of compromise, names the exact CVE, or responds publicly to 360's claim. Until then, treat "latest build plus no internet-facing login" as the baseline, not the 2024 minimum.
Sources
- BleepingComputer — Synology warns of C3RB3R ransomware attacks targeting NAS devices bleepingcomputer.com
- Techaeris — Synology NAS ransomware alert: C3RB3R locks files with .L0CK3D techaeris.com
- WindowsForum — Synology NAS C3RB3R ransomware attacks: update DSM and check your backups windowsforum.com
- DEV Community — C3RB3R ransomware hits unpatched Synology NAS devices through flaws fixed almost two years ago dev.to
