Synology says attackers are encrypting data on network-attached storage (NAS) devices that still run outdated versions of its DSM operating system, and demanding a ransom. The company says the flaw being abused was patched in December 2024, so devices that never received that update are the ones at risk.
What happened
In a statement dated October 29, 2026, Synology said it had identified threat actors exploiting a vulnerability that it fixed in December 2024. The attacks aim to encrypt stored data and extort payment, according to the company. Synology urged owners of vulnerable versions to update DSM immediately and recommended turning on automatic updates.
Synology has not said which specific vulnerability is being exploited. Its advisory SA-24:20, first published in November 2024, covers three flaws: CVE-2024-10441 (CVSS 9.8, remote code execution in a system plugin daemon), CVE-2024-50629 (CVSS 5.3, limited file read) and CVE-2024-10445 (CVSS 4.3, limited file write). Security Affairs and The Hacker News both note that Synology has not confirmed which of them is involved. The advisory lists no workaround other than updating.
The Hacker News reports that the ransomware is being called C3RB3R and that victims see files renamed with a .L0CK3D extension. That report attributes both details to customer reports on Reddit; Synology’s statement does not use the name, and we could not independently verify it.
Who is affected
Anyone running DSM below the fixed builds in the advisory. Those builds are:
- DSM 7.2.2: 7.2.2-72806-1 or later
- DSM 7.2.1: 7.2.1-69057-6 or later
- DSM 7.2: 7.2-64570-4 or later
- DSM 7.1: 7.1.1-42962-7 or later
- DSM 6.2: 6.2.4-25556-8 or later
The advisory also covers Synology BeeStation OS before 1.1-65374. Hong Kong’s CERT (HKCERT) issued its own alert on November 2 and notes that installing updates will not decrypt files that are already encrypted.
What to do
From Synology: update DSM to a fixed build and enable automatic updates. The steps below come from HKCERT, plus our own analysis where noted.
- Check your DSM version now and update if it is below the builds listed above.
- Do not expose the NAS management interface to the internet (HKCERT advice; our analysis is that remote access should go through a VPN instead).
- If a device is already encrypted, disconnect it from the network, keep the evidence, and avoid resetting or formatting it.
- Restore only from clean or offline backups. HKCERT advises against relying on paying the ransom.
- Our analysis: keep at least one backup copy that is not reachable from the NAS itself, since ransomware targets connected shares.
What we still do not know
The sources we read give no count of affected devices or victims, no ransom amounts, and no confirmed list of exploited CVEs. It is also unclear how attackers reach the devices. HKCERT says Synology has not confirmed whether the separate PHP2Shell flaws play a role, and it is not known whether BeeStation devices are being hit.
Sources: Synology press release (Oct. 29, 2026); Synology-SA-24:20 (Nov. 5, 2024, updated Mar. 2025); The Hacker News (Nov. 3, 2026); Security Affairs (Nov. 3, 2026); HKCERT (Nov. 2, 2026).
Leave a Reply