Synology says attackers are encrypting NAS drives running outdated DSM through a flaw it fixed in December 2024. Qihoo 360 ties the campaign to two 9.8-rated bugs patched in September 2026. The fix for both is the same: install the current DSM build and take DSM off the open internet.
If you keep a Synology NAS at home or in a small office, check its DSM version today. Synology says attackers are encrypting data on boxes that run outdated DSM, and the files come back renamed with a .L0CK3D extension and a ransom note. Install the newest DSM build for your model, turn on automatic updates, and stop exposing the DSM login page to the internet.
What Synology confirmed
In a ransomware alert dated October 29, Synology says threat actors are exploiting a vulnerability it patched in December 2024 to attack devices running old DSM versions, with the goal of encrypting data and demanding a ransom. It points to its advisory Synology-SA-24:20. That advisory’s critical bug, CVE-2024-10441, rated 9.8 out of 10, lets a remote attacker run code on the NAS. Synology’s advice is two lines: update DSM immediately and enable automatic updates. It lists no other mitigation.
The attacks drew wider coverage on November 2, when The Hacker News and BleepingComputer reported Synology’s warning. The Hacker News also linked customer reports of infections on Reddit.
A second, newer entry point
Chinese security firm Qihoo 360 says the campaign also uses two newer flaws, according to IT-Connect, which cites 360’s October 29 bulletin. Synology has not confirmed that link. Both bugs are real and critical: Synology’s own advisory Synology-SA-26:13, published September 18, 2026, rates CVE-2026-13639 (login logic) and CVE-2026-13684 (SCGI) at 9.8. Each lets a remote attacker read and write arbitrary files with no login.
Per IT-Connect’s summary of 360’s findings:
- 360 has fielded help requests from Synology owners since early October 2026.
- C3RB3R is a variant of the Cerber ransomware family. It encrypts files with ChaCha8 and protects the keys with RSA-2048.
- Each folder gets a ransom note named read-me3.txt that points to a Tor site.
No free decryptor has been reported.
Which DSM build you need
The September advisory is the newer bar, so meet it. These are the minimum fixed builds Synology lists for each branch:
| Your DSM branch | Install at least |
|---|---|
| DSM 7.4 | 7.4-90075 |
| DSM 7.3 | 7.3.2-86009-4 |
| DSM 7.2.2 | 7.2.2-72806-9 |
| DSM 7.2.1 | 7.2.1-69057-12 |
Those builds also clear the 2024 flaw. If your NAS is on DSM 7.2, 7.1 or 6.2, Synology-SA-24:20 lists 7.2-64570-4, 7.1.1-42962-7 and 6.2.4-25556-8 as the fixed builds, but none of those branches appears in the September advisory. If your model is stuck on an old branch, keep it off the internet and plan a replacement.
What to do this week
- Update. In DSM, open Control Panel, then Update & Restore, and install the latest build. Turn on automatic updates in the same screen.
- Close the door. Remove any router port forward that points at DSM (ports 5000 and 5001 by default). For remote access, use a VPN such as Tailscale or your router’s own VPN. IT-Connect also recommends this.
- Harden the login. Disable the default admin account, turn on two-factor authentication and enable auto block for repeated failed logins.
- Protect the data. Turn on immutable or write-protected snapshots for shared folders if your model supports them, and keep one backup copy offline. RAID protects against a dead drive. It does nothing against ransomware.
- Check the packages. Update or remove add-ons you no longer use. IT-Connect names PHP, Mail Station and Synology Calendar.
Small-office NAS boxes have become a ransomware target
A NAS on a home or office network often holds the only copy of client files, shared drives and laptop backups. That makes it worth more to an attacker than a single laptop. The pattern here is a patch that sat uninstalled. Synology fixed the 2024 bug almost two years ago, and the 2026 bugs about three weeks before 360 says the first help requests arrived. For a remote team, the NAS should get the same patch discipline as the laptops it backs up. If it holds work data, the backup that matters is the one that is not on the NAS. A related risk sits on the same networks: cheap streaming boxes with a factory backdoor.