Ransomware
Synology warns of ransomware attacks on unpatched NAS devices and urges users to install the latest DSM now
Synology has detected attacks that encrypt data on its NAS devices and demand a ransom by exploiting DSM flaws that have already been patched. Many SMEs keep their documents and backups on these devices: this week it's worth checking that yours is up to date and can't be managed from the internet.
Synology — Maker of the targeted NAS devices and of the DSM system
In 30 seconds
- Synology confirmed on 29 October that attackers are encrypting data and demanding ransoms on NAS devices running old versions of DSM, its operating system.
- According to Synology, they exploit a vulnerability patched in December 2024. Security firm 360, however, points to two critical flaws that Synology fixed on 18 September 2026.
- 360 identifies the ransomware as C3RB3R, a variant of the Cerber family that adds the .L0CK3D extension to encrypted files, and advises against paying the ransom.
- The fix is the same in both cases: update DSM to the latest available version and turn on automatic updates, as Synology asks.
Does this affect me?
It affects you if your company stores documents or backups on a Synology NAS and hasn't updated it in recent months, especially if it can be reached from outside the office. It doesn't affect you if you don't have a NAS from this brand. No Spanish victims have been confirmed, but these devices are very common in SMEs, accounting firms and professional practices.
What happened
On 29 October 2026, Synology published a statement confirming that it has identified threat actors exploiting a vulnerability patched in December 2024 to target devices running outdated versions of DSM, the operating system of its NAS servers. According to the vendor, "these attacks aim to encrypt data and extort ransom".
Synology "strongly urges" anyone running a vulnerable version to update DSM immediately and recommends turning on automatic updates. The statement refers to security advisory Synology-SA-24:20.
The same day, Chinese security firm 360 published its own alert: since October it has handled several cases of Synology NAS devices attacked with C3RB3R, a variant of the long-running Cerber ransomware family.
What we know
- The advisory Synology refers to (SA-24:20, published 5 November 2024) is rated critical and includes a flaw, CVE-2024-10441, with a CVSS score of 9.8, that lets a remote attacker run code on the NAS. The fixed versions are DSM 7.2.2-72806-1, 7.2.1-69057-6, 7.2-64570-4, 7.1.1-42962-7 and 6.2.4-25556-8, or later.
- 360's account is different: it attributes the cases it has handled to CVE-2026-13639 and CVE-2026-13684, two critical flaws (CVSS 9.8) that allow files to be read and written without a password. Synology fixed them on 18 September 2026 in advisory SA-26:13: you need DSM 7.4-90075, 7.3.2-86009-4, 7.2.2-72806-9 or 7.2.1-69057-12, or later. Synology offers no alternative to updating.
- How to recognise it: according to 360, encrypted files end in .L0CK3D and a ransom note appears in every folder. 360 adds that "many devices have still not updated their systems" and asks victims not to pay the ransom.
What we don't know yet
- Exactly which flaw is being used. Synology talks about a December 2024 vulnerability without specifying which; 360 points to two flaws from September 2026. It isn't clear whether they describe the same attacks, so we don't treat a single version as confirmed.
- How many devices have been attacked and in which countries. Neither source gives figures.
- Whether there are victims in Spain. None have been confirmed.
Why it matters
In many companies, the NAS is where everything lives: the shared folders, client documents and, very often, the backups of the computers. If it gets encrypted, you lose both the company's archive and the copy that was meant to recover it.
And the pattern repeats once again: the patches existed. One of the flaws has been fixed for almost two years.
What it means for an SME
Synology is one of the most widespread NAS brands in SMEs, accounting firms and professional practices. It's usually installed by the IT provider and keeps running for years. In practice:
- nobody in the company knows which version of DSM it runs;
- it was often left reachable from the internet to work from home or from a phone, which is exactly what these attacks exploit;
- the backups sit on the NAS itself, or on a disk connected to it, and would fall in the same attack.
What your company should do this week
- Ask your IT provider whether you have a Synology NAS and which version of DSM it runs. If it isn't the latest available for that model, ask them to update it now and turn on automatic updates, as Synology recommends.
- If the NAS runs an old version that doesn't appear in the advisories, ask whether that model still receives updates or whether it's time to replace it.
- Check that the admin panel isn't open to the internet. If access from outside is needed, it should go through a VPN.
- Make sure you have a backup outside the NAS, disconnected or in another location, and that someone has tried restoring it. Our guide to the 3-2-1 backup rule (in Spanish) explains how to organise it.
- If you see files ending in .L0CK3D, disconnect the NAS from the network without switching it off if possible, don't pay the ransom and call your provider or an incident response team.
Sources
- Synology — «Synology urges users to update DSM following ransomware attacks on outdated DSM versions» (29 October 2026)Primary source
- Synology — security advisory Synology-SA-24:20 (DSM), published 5 November 2024Primary source
- Synology — security advisory Synology-SA-26:13 (DSM), published 18 September 2026Primary source
- 360 — alert on Cerber ransomware attacks against Synology NAS (29 October 2026, in Chinese)
- IT-Connect — «C3RB3R Ransomware Is Hitting Synology NAS Devices: How to Protect Yours» (Florian Burnel, 29 October 2026)
Defentria editorial team. The Defentria team selects cybersecurity news from primary sources (CERTs, official bodies and vendors) and explains what it means for a Spanish SME and what to do about it.
