Synology NAS devices are under ransomware attacks, encrypting user files and demanding thousands in payment. Updates and security measures are critical to prevent breaches.
Ransomware targets Synology NAS devices
A wave of ransomware attacks has been targeting Synology Network Attached Storage (NAS) devices, encrypting users' files and demanding thousands of dollars for decryption. Since mid-October, users have reported their files—photos, documents, and backups—being locked with a ransom note.Synology confirms the attacks
On October 29, Synology acknowledged the attacks and urged users to update their operating system immediately. The ransomware identified is C3RB3R, also known as CerberImposter, which has been linked to previous attacks on servers and exploits known vulnerabilities.Ransomware demands payment for decryption
The hackers have encrypted files with the .L0CK3D extension and left a document titled read-me3.txt explaining the encryption. They demand payment for a decryption tool called C3rb3r Decryptor, available on the dark web, and even offer to restore one file for free to encourage payment.Vulnerabilities exploited in the attacks
Synology mentioned a vulnerability fixed in December 2024 but did not name it. However, cybersecurity researchers from 360 have linked the attacks to two other critical flaws, CVE-2026-13639 and CVE-2026-13684, which were patched in September 2026. These flaws allowed unauthorized access and execution of code on the devices.Many Synology devices remain exposed
As of November 1, the Shadowserver Foundation reported over 380,000 Synology devices accessible from the Internet, with nearly 200,000 in Europe. This exposure increases the risk of attacks, especially for devices running outdated software versions.Synology advises users to update and secure their devices
Synology recommends users install the latest version of DiskStation Manager (DSM) compatible with their device and enable automatic updates. It also advises checking for open access to the DSM interface on the Internet and using secure methods like a VPN or the manufacturer’s service for remote access.Additional security steps for users
Users are encouraged to disable the default administrator account, enable two-factor authentication, and maintain an independent offline backup. These steps can help prevent unauthorized access and provide a recovery option if files are encrypted despite precautions.Updates won’t decrypt already locked files
Even if users update their devices after an infection, the updates will only fix the vulnerability. They will not decrypt files that have already been encrypted by the ransomware, emphasizing the importance of regular backups.
