Synology has issued a rare attack warning: C3RB3R ransomware is encrypting DiskStation and RackStation NAS devices that are still running DSM builds patched back in December 2024. Victims find a read-me3.txt note and a .L0CK3D extension on their files, with a link to buy a decryptor.
What happened
Synology attributes the campaign to threat actors exploiting a vulnerability that was fixed in December 2024. The company did not name the exact CVE, pointing instead to its November 2024 advisory covering three DSM flaws: CVE-2024-10441, a 9.8 remote code execution bug in the system plugin daemon, plus CVE-2024-50629 (limited file read, 5.3) and CVE-2024-10445 (limited file write, 4.3).
Reports from affected owners started appearing in forums and on Reddit more than two weeks before the advisory. Shadowserver currently tracks over 380,000 internet-exposed Synology NAS devices and cannot say how many are patched or are honeypots.
Who is affected
Any Synology NAS that answers on the internet and has not been updated since late 2024, which in practice means a lot of small offices that set the box up once and never logged in again.
- DSM 7.2.2 below 7.2.2-72806-1
- DSM 7.2.1 below 7.2.1-69057-6
- DSM 7.2 below 7.2-64570-4
- DSM 7.1 below 7.1.1-42962-7
- DSM 6.2 below 6.2.4-25556-8 (rated moderate, still fixable)
What to do now
Update DSM, then remove the management interface from the internet. The patch alone does not help a box that is still being scanned every hour.
- Upgrade DSM to the fixed build for your branch, then enable automatic updates so this does not repeat.
- Block port 5000/5001 and QuickConnect from the WAN; use VPN or Tailscale for remote access instead.
- Disable the default admin account, enforce MFA on DSM accounts, and check for unknown users or scheduled tasks.
- Confirm your off-NAS backup is current and offline. A snapshot on the same box is not a backup.
- If files already carry .L0CK3D, isolate the device before restoring, or the restore gets encrypted too.
What this means for South African businesses
Synology is the default small-office NAS here, usually bought for file sharing and backup and then exposed through QuickConnect so staff can reach it from home. That combination is exactly what this campaign looks for. My judgement: the risk is not the sophisticated attacker but the box nobody has logged into since installation, and most SMEs will only discover the problem when the accounting files will not open.
Source: BleepingComputer and the Synology advisory.
Also on the blog
- Barracuda ESG CVE-2026-116606: 9.3 auth bypass that ends in root
- GitLab CVE-2026-97229: CVSS 10.0 CI/CD flaw, 1,000 servers still exposed
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.