Synology NAS Hit by C3RB3R Ransomware (.L0CK3D): Synology Blames Unpatched DSM, Fixed Versions Listed

Synology has told owners of its NAS devices to update DiskStation Manager (DSM) after ransomware attacks on boxes running old versions. Attackers are "exploiting a vulnerability patched in December 2024" to encrypt data and extort a ransom, the Taiwanese company said on 29 October. Victims find their files renamed with a .L0CK3D extension and a ransom note called read-me3.txt in each folder, according to a bulletin from Chinese security firm Qihoo 360. The note is headed "C3RB3R INSTRUCTIONS", Chinese outlet Kuai Keji reports.

Which flaw is being used

Synology's statement names no CVE. It points to advisory Synology-SA-24:20, the bugs shown at Pwn2Own in 2024, among them CVE-2024-10441, a remote code execution flaw scored 9.8. A victim who published forensics on GitHub found a box on DSM 7.2-64561 Update 0 and traced the entry to that flaw. A proof-of-concept exploit for it had appeared on GitHub days earlier, IT-Connect reports.

Qihoo 360 sees it differently. Its bulletin says this round of attacks enters through CVE-2026-13639 and CVE-2026-13684, two critical DSM bugs that Synology fixed in advisory SA-26:13 on 18 September: a login-logic flaw and a file read/write flaw in SCGI, both scored 9.8. Some users told Kuai Keji their DSM was newer than the version Synology recommends and was still encrypted.

Who has been hit

No victim count has been published.

Most reports came from Chinese forums, says IT-Connect, and a victim support thread on BleepingComputer's forum includes an owner who gives the attack time as 28 October in UTC+7, the time zone of Thailand, Vietnam and western Indonesia, with SMB forwarded to the internet. That's one person's account and hasn't been confirmed.

What to do

Update DSM to at least the builds listed in Synology-SA-26:13. On the 7.2.1 and 7.2.2 branches these builds are later than the SA-24:20 fixes, so one update covers both advisories:

• DSM 7.4: 7.4-90075 or later.
• DSM 7.3: 7.3.2-86009-4 or later.
• DSM 7.2.2: 7.2.2-72806-9 or later.
• DSM 7.2.1: 7.2.1-69057-12 or later.
• DSM 7.1 and 6.2: at least 7.1.1-42962-7 and 6.2.4-25556-8, the SA-24:20 fixes. SA-26:13 doesn't list these branches.

Synology also recommends turning on automatic updates. Qihoo 360 adds that NAS admin ports shouldn't be mapped straight to the internet, and that remote access should go through the vendor's relay service or a VPN. The GitHub victim's guide warns anyone who finds encryption under way not to reboot, power off or upgrade before preserving the scene.