Synology is urging customers to immediately update the DiskStation Manager (DSM) software running on its Network Attached Storage (NAS) devices following reports of ransomware attacks exploiting security vulnerabilities in outdated systems.
The Taiwanese technology company said it had identified threat actors exploiting a vulnerability patched in December 2024 to compromise NAS devices running older DSM versions.
According to Synology, the attacks are designed to encrypt files stored on affected devices and demand ransom payments from victims.
“These attacks aim to encrypt data and extort ransom,” the company said in a statement released last week.
Although Synology has not identified the exact vulnerability being exploited in the latest campaign, it referenced a November 2024 security advisory covering three security flaws affecting DSM.
The company strongly recommends that customers running vulnerable versions upgrade their systems to the latest available releases.
Three DSM Vulnerabilities Highlighted in Synology Security Advisory
Synology’s November 2024 advisory identified three vulnerabilities that could expose NAS devices to different types of attacks.
The security issues include:
- CVE-2024-10441 (CVSS score: 9.8): An improper output encoding or escaping vulnerability in DSM’s system plugin daemon that could allow remote code execution through unspecified attack vectors.
- CVE-2024-50629 (CVSS score: 5.3): An improper output encoding or escaping vulnerability in the DSM WebAPI component that could allow remote attackers to read limited files.
- CVE-2024-10445 (CVSS score: 4.3): An improper certificate validation vulnerability in DSM’s update functionality that could allow remote attackers to write limited files.
Synology addressed these vulnerabilities through software updates released for multiple DSM branches.
DSM Versions That Include Security Fixes
Customers running the affected versions should ensure their NAS devices are updated to at least the following releases:
| DSM version | Minimum fixed version |
|---|---|
| DSM 7.2.2 | 7.2.2-72806-1 |
| DSM 7.2.1 | 7.2.1-69057-6 |
| DSM 7.2 | 7.2-64570-4 |
| DSM 7.1 | 7.1.1-42962-7 |
| DSM 6.2 | 6.2.4-25556-8 |
Users should check Synology’s official security advisories for the latest updates and applicable upgrade instructions.
C3RB3R Ransomware Targets Synology NAS Devices
The warning comes amid customer reports of Synology NAS devices being compromised by a ransomware family known as C3RB3R.
According to reports, the ransomware encrypts files on affected devices and appends the .L0CK3D extension to compromised files.
In an analysis published last week, Chinese cybersecurity company Qihoo 360 Internet Security Center said C3RB3R has a history of targeting NAS devices by exploiting security vulnerabilities.
Researchers identified two additional DSM vulnerabilities that Synology addressed in September 2026.
These include:
- CVE-2026-13684 (CVSS score: 9.8): An improper output encoding or escaping vulnerability in SCGI that could allow remote attackers to read or write arbitrary files and trigger denial-of-service conditions.
- CVE-2026-13639 (CVSS score: 9.8): An insufficient entropy vulnerability in login logic that could allow remote attackers to read or write arbitrary files and conduct denial-of-service attacks.
These vulnerabilities highlight the importance of keeping NAS firmware and management software updated, particularly when devices are accessible through the internet.
How C3RB3R Ransomware Encrypts Files
Once executed on a compromised NAS device, C3RB3R scans files and encrypts targeted data.
However, the malware reportedly avoids certain directories and file extensions to prevent interference with system operations and preserve its encryption process.
The ransomware skips 27 directories and excludes several file types, including:
- BAT
- DLL
- EXE
- LNK
- MOD
- MSI
- SYS
Files successfully encrypted by the malware receive the .L0CK3D extension.
The ransomware also creates a ransom note named read-me3.txt in each affected directory, providing instructions for victims.
By avoiding critical system files and directories, the malware can encrypt valuable user data while reducing the likelihood of disrupting the device before completing its attack.
NAS Devices Have Faced Repeated Ransomware Attacks
This is not the first time network-attached storage devices have been targeted by ransomware operators.
In 2019, NAS devices manufactured by Taiwan-based QNAP Systems were affected by QNAPCrypt, also known as eCh0raix ransomware.
The malware targeted vulnerable NAS systems and encrypted files belonging to affected users.
In August 2021, Synology warned customers about brute-force attacks conducted by a malware operation known as StealthWorker.
The attackers used previously compromised devices to repeatedly guess commonly used administrator credentials.
When successful, they accessed vulnerable systems and installed malicious payloads, potentially including ransomware.
Synology explained at the time:
“These attacks leverage a number of already infected devices to try and guess common administrative credentials, and if successful, will access the system to install its malicious payload, which may include ransomware.”
The company also warned that infected devices could be used to attack other Linux-based systems, including additional Synology NAS devices.
During the same month, Palo Alto Networks’ Unit 42 disclosed details of an eCh0raix ransomware variant targeting both QNAP and Synology NAS products.
The campaign reportedly exploited vulnerabilities such as CVE-2021-28799 and also used brute-force attacks against devices protected by weak or commonly used administrative passwords.
How Synology NAS Users Can Protect Their Devices
Synology is strongly encouraging customers to update DSM immediately to reduce the risk of ransomware infections and other security compromises.
Users should consider the following security measures:
- Update DSM immediately: Install the latest available security updates for your specific NAS model and DSM branch.
- Enable automatic updates: Turn on automatic software updates where supported to ensure important security fixes are installed promptly.
- Strengthen administrator passwords: Replace weak or reused passwords with unique, complex credentials.
- Enable multi-factor authentication: Add another layer of protection to administrator and other important accounts.
- Restrict internet exposure: Avoid exposing NAS management interfaces directly to the public internet unless absolutely necessary.
- Review remote access settings: Disable unnecessary services and restrict access to trusted users and networks.
- Maintain offline backups: Keep separate backups of important files so that data can be recovered if ransomware encrypts the NAS.
- Monitor suspicious activity: Regularly review login records, system notifications, and unexpected changes to files or accounts.
Synology also recommends that customers avoid delaying security updates, particularly when their devices are running software versions affected by known vulnerabilities.
Conclusion
The latest ransomware warning from Synology highlights the continuing security risks facing NAS devices used by businesses and individuals to store important data.
The reported C3RB3R attacks demonstrate how outdated software and exposed NAS infrastructure can become attractive targets for ransomware operators.
Although Synology has not confirmed which specific vulnerability was exploited in the latest attacks, its warning makes clear that customers should prioritize DSM security updates.
Keeping NAS software current, restricting unnecessary remote access, strengthening authentication, and maintaining reliable offline backups can significantly reduce the impact of ransomware attacks.
Synology users should check their DSM versions and install the latest available security updates without delay.
