601/69 Tuesday, November 3, 2026
Synology has warned users of its Network Attached Storage (NAS) devices after detecting attacks that exploit vulnerabilities patched in December 2024 against systems still running older versions of DiskStation Manager (DSM). The attacks encrypt files and demand ransom payments. Reports from affected users have linked the activity to the C3RB3R ransomware, with encrypted files receiving the .L0CK3D extension and a ransom note named read-me3.txt. Synology has not disclosed how many devices have been affected and has not identified which specific vulnerability is being exploited in the campaign.
Synology referenced advisory Synology-SA-24:20, which covers three vulnerabilities: CVE-2024-10441, which could allow an attacker to execute commands on the system; CVE-2024-50629, which could allow access to certain files; and CVE-2024-10445, which is associated with file-writing under specific conditions. However, the company has not confirmed which of these vulnerabilities, if any, is being used in the C3RB3R campaign. As a result, the exact vulnerability serving as the attackers’ entry point remains unconfirmed.
Administrators of Synology NAS devices should update DSM to the latest version supported by their device and enable automatic updates. According to Synology-SA-24:20, patched releases include DSM 7.2.2-72806-1, 7.2.1-69057-6, 7.2-64570-4, 7.1.1-42962-7, and 6.2.4-25556-8, or later versions within the respective release branches. Administrators should also avoid exposing NAS management interfaces directly to the internet and restrict access to internal networks or VPN connections where possible. If files with the .L0CK3D extension or a read-me3.txt ransom note are found, the affected device should be isolated from the network, relevant evidence preserved, and the scope of the compromise assessed before data recovery begins.