Synology NAS Ransomware Hits Outdated DSM

Synology NAS ransomware is hitting devices that run outdated DSM versions. On October 29, Synology said attackers are exploiting a vulnerability it patched in December 2024 to encrypt data and demand a ransom. Qihoo 360 names the malware C3RB3R, a Cerber variant. As of November 2, which flaw gets attackers in is disputed, and neither Synology nor the reports we read show a new zero-day.

What Happened in the Synology NAS Ransomware Attacks

Synology’s notice says threat actors exploit a flaw fixed in December 2024 against NAS devices on outdated DiskStation Manager (DSM) versions, urges immediate updates, recommends automatic updates and points to advisory Synology-SA-24:20. It names no CVE. That advisory covers CVE-2024-10441, and heise reports that the flaws it addresses became public at Pwn2Own in late October 2024. The notice gives no victim count and no ransom details.

The entry point is not settled. Qihoo 360’s report of October 29 says its anti-ransomware team investigated several attacks on Synology NAS devices since early October and found the entry point in two newer flaws from advisory Synology-SA-26:13, published on September 18, 2026: CVE-2026-13639 and CVE-2026-13684, both CVSS 9.8, fixed in DSM 7.4-90075, 7.3.2-86009-4 and 7.2.2-72806-9. Synology has not confirmed that link, and 360 speaks only for the cases it examined. 360 also describes encrypted files renamed with the extension .L0CK3D and a ransom note named read-me3.txt in each affected folder. As of the October 30 catalog version, none of the three CVEs is in the CISA KEV catalog.

Why It Matters

A NAS is where many mid-sized companies keep their backups, and a device that stays on an old DSM version for nearly two years after a 9.8-rated fix is an easy target. If the attackers reach the NAS, the data and the copies next to it are at risk together.

Assumption: many NAS devices in small and mid-sized offices are managed by whoever set them up, with remote access left on for convenience and updates done rarely. If so, they are the unmanaged edge devices that fall outside normal patch cycles. Under NIS2, backup integrity is part of the resilience duties, so an outdated NAS is also an audit finding.

What You Should Do Now

1. Check the DSM version under Control Panel, Update & Restore, and compare it with the fixed builds in Synology-SA-24:20 and Synology-SA-26:13 (SA-26:13: DSM 7.4-90075, 7.3.2-86009-4, 7.2.2-72806-9). Update now and switch on automatic updates.
2. Remove direct internet access to DSM. Check the router for port forwards to the NAS, check whether QuickConnect or DDNS exposes the admin interface, and use a VPN for remote access instead.
3. Protect the backups. Keep snapshots, and keep at least one copy outside the NAS that the NAS credentials cannot reach (offline or immutable storage). Test a restore.
4. Look for signs of compromise: unknown admin accounts, unexpected logins in the log, files ending in .L0CK3D. If files are encrypted, disconnect the device from the network, keep the logs and restore from the offline copy.

DIESEC Perspective

The fix in this story is almost two years old. Nobody applied it because nobody owned the box. Name one person responsible for every NAS and storage device, put it on the same patch calendar as the servers, and review once a quarter which of them are reachable from the internet.

Not sure whether your NAS is exposed or your backups survive an attack? Contact DIESEC for an exposure check and a backup resilience review.

Sources: Synology notice | Synology-SA-26:13 | Synology-SA-24:20 | heise online | Qihoo 360 (Chinese)
Published: 2026-11-04 | Category: Ransomware & Extortion | ~4 min read