Synology NAS users face ransomware attacks using old vulnerabilities. Experts warn of encrypted files and urge immediate security checks.
Ransomware attacks target Synology NAS devices
Since early October, the 360 Anti-Ransomware Service, a Chinese cybersecurity firm, has been assisting users of Synology NAS devices after they were infected with ransomware. The attacks have encrypted users' data, with criminals demanding payment for a decryption key.C3RB3R ransomware identified
In a report published on October 29, 360 identified the ransomware as C3RB3R, a variant of the Cerber family. This type of malware has targeted NAS devices for years. Encrypted files receive the .L0CK3D extension, and a ransom note called read-me3.txt appears in affected folders.Synology confirms a known vulnerability
Synology, the Taiwanese manufacturer of the NAS devices, stated that hackers are exploiting a vulnerability fixed in December 2024. The company said that the attacks are targeting devices still running an older version of DSM, the operating system used on its NAS devices.Newer vulnerabilities may also be involved
The 360 report suggests that the attacks could also involve two critical vulnerabilities disclosed and fixed by Synology on September 18, 2026. These vulnerabilities allow unauthorized access to files on the NAS without needing login credentials.Uncertainty about the attack source
Solar, a Chinese cybersecurity team, shared a screenshot of an encrypted Synology device running DSM 7.4.1-90080 Update 1, the latest version at the time. However, Solar has not confirmed whether a zero-day vulnerability exists or if a third-party package or stolen credentials were involved.Victims seek help online
Victims of the ransomware attacks are turning to online forums like r/synology on Reddit for guidance. Some are asking what steps to take before restoring their data, while others are trying to understand what is happening with their devices.Steps to check your Synology NAS
Users should check three things: whether their files are still accessible, if any unknown file extensions have appeared, and if the administration interface is accessible from the internet. They should look for files with .L0CK3D or .LOCK3D extensions and the read-me3.txt note in shared folders.Security measures to take
Users should update their DSM operating system to the latest version available through the Control Panel, ensuring they are not on an outdated branch. They should disable remote access ports and UPnP on their router, limit QuickConnect, and enable two-factor authentication. If infected, they should disconnect from the network, avoid paying the ransom, and contact Synology support with their DSM version and logs.No free decryption tool available yet
As of October 30, no free decryption tool has been released for C3RB3R. The No More Ransom website, supported by Europol and the Dutch police, offers a resource to check if a decryption tool exists for any ransomware. Users can upload an encrypted file and the ransom note to check for available solutions.
