Skip to content
Rush Commerce
Software & Dev2 min read

Synology NAS ransomware: C3RB3R hits outdated DSM

Synology warns C3RB3R ransomware is encrypting NAS boxes on outdated DSM. Files get .L0CK3D. Update DSM, turn on auto-updates, and keep an offline backup.

Synology says attackers are using ransomware on Synology NAS devices that run outdated DSM. The campaign is called C3RB3R. Encrypted files get a .L0CK3D extension. In plenty of small offices, the NAS holds the file share, the backups and the camera footage. If that box is still on 2024 firmware, update it today.

What actually happened

In an October 29 notice, Synology said attackers are exploiting a vulnerability patched in December 2024. The attacks encrypt data and demand a ransom. Synology pointed customers to advisory Synology-SA-24:20, which includes CVE-2024-10441, a remote code execution bug rated 9.8.

BleepingComputer and The Hacker News added the details:

  • The calling card. Files renamed to .L0CK3D, plus a ransom note called read-me3.txt that pushes a paid "C3rb3r Decryptor."
  • Which bug. Synology hasn't said which CVE the attackers use. Chinese security firm Qihoo 360, quoted by The Hacker News, links the attacks to two newer DSM flaws fixed in September 2026 under SA-26:13.
  • Exposure. BleepingComputer cites Shadowserver's count of more than 380,000 Synology NAS devices reachable from the internet. That counts exposed boxes, not infected ones.
  • Victim count. Synology didn't give one.

Some reports call this Synology's first ransomware warning since 2019. The Hacker News lists a 2021 Synology warning, so we left that claim out.

Why the Synology ransomware matters for your business

A NAS is often a small business's only backup. If ransomware encrypts the backup along with everything else, there's nothing to restore. Here's what to do:

  1. Update DSM to the newest build for your branch. Patching for SA-24:20 isn't enough. The latest build covers SA-26:13 as well, and that's the version Qihoo 360 says is being exploited.
  2. Turn on automatic updates. Synology recommends this, and it's the step most owners skip.
  3. Take DSM's admin page off the internet. No port forwards to 5000/5001. If you need remote access, use a VPN.
  4. Keep one backup the NAS can't write to. Use an offline drive or immutable cloud storage. Snapshots on the same box don't count.

If your NAS shows .L0CK3D files, disconnect it from the network before you do anything else.

Key takeaways

  • C3RB3R ransomware is encrypting Synology NAS devices on outdated DSM
  • Synology points to SA-24:20 (CVE-2024-10441); Qihoo 360 links newer SA-26:13 flaws
  • Encrypted files end in .L0CK3D with a read-me3.txt ransom note
  • Update to the newest DSM build and turn on automatic updates
  • Block admin access from the internet and keep a backup the NAS can't touch

Is your only backup sitting on the box ransomware would encrypt? We set up small-business storage with backups the NAS can't write to, and remote access that doesn't open ports. Book a backup check, or see what we do.

Sources: Synology, BleepingComputer, The Hacker News.

  • #synology
  • #ransomware
  • #nas
  • #dsm
  • #small-business-it
TR

Tommy Rush — Founder, Rush Commerce

Operator turned builder. 15+ years running operations — now shipping the systems businesses run on. More

Get The Rush Report weekly — one email, zero fluff.

Keep reading

Software & Dev3 min read

Truffle Security will get your leaked API keys revoked

Truffle Security's Secrets Revocation Program sends 1.4M live leaked API keys to Twilio, Vercel, Resend and others to revoke. Make key rotation a five-minute job.

Read it
Software & Dev3 min read

mSecure password manager breach: what to reset first

mSecure's maker told current and former customers to change passwords, reset 2FA and remove passkeys after a breach. Here's the order we'd do it in.

Read it