Synology has warned of C3RB3R ransomware attacks against NAS devices running outdated DiskStation Manager (DSM). Attackers exploit already-fixed flaws to encrypt files and extort victims. If your company uses a Synology NAS, especially one reachable from the internet, check your DSM version today, update it and shut off remote access to the admin interface.
Key facts
- Synology says attackers are exploiting a vulnerability fixed in late 2024 on outdated DSM versions. The advisory it links lists three CVEs: CVE-2024-10441 (CVSS 9.8, remote code execution in the system plugin daemon), CVE-2024-50629 (file read) and CVE-2024-10445 (file write). It has not said which one is being exploited.
- Fixed versions: DSM 7.2.2-72806-1, 7.2.1-69057-6, 7.2-64570-4, 7.1.1-42962-7 and 6.2.4-25556-8, or later in each branch.
- According to Qihoo 360, C3RB3R has also exploited two DSM flaws fixed in September 2026: CVE-2026-13684 and CVE-2026-13639, both rated CVSS 9.8.
- Encrypted files get the .L0CK3D extension and the attack drops a ransom note called read-me3.txt. The first victim reports appeared more than two weeks ago, according to BleepingComputer.
- Shadowserver tracks more than 380,000 internet-exposed Synology NAS devices. It doesn't say how many are already protected or how many are honeypots.
Does this affect me if I have a Synology NAS in the office?
Yes, if you haven't updated it. The risk is higher if the NAS is reachable from the internet: for example, because you opened the web interface to log in from home or to let a provider manage it remotely.
In a small business the NAS usually acts as the file server and, often, as the backup target too. If C3RB3R gets in, it can encrypt your documents and your backups at the same time. The sources give no figure for exposed devices in Spain.
How do I know if I've already been hit?
Look for two signs: files with the .L0CK3D extension and a read-me3.txt file in your shared folders. If you see them, don't blindly update or reboot. Disconnect the NAS from the network and alert whoever runs your IT. Updating closes the door, but it doesn't undo encryption that has already happened.
Why now, if the flaw was fixed in 2024?
Because many NAS devices never get updated. They're installed, they work, and nobody touches them again. Synology rarely issues warnings about attacks on its customers: the previous one was in August 2019, after brute-force attacks led to eCh0raix infections. That it's speaking up now signals a serious wave. One detail: The Hacker News and BleepingComputer disagree on the month of the fix (November or December 2024), and we were unable to read Synology's original advisory.
What to do today
- Check the DSM version on every NAS you own.
- Update to the fixed version for your branch or, better, to the latest available release, which includes the September 2026 fixes.
- Turn on automatic updates, as Synology recommends.
- Block access to the web admin interface from the internet.
- If you need remote access, use a VPN instead of exposing the NAS.
- Make sure you have a backup outside the NAS, offline or immutable, and that you can restore it.
- If you find .L0CK3D files, disconnect the device and alert your IT provider.
What it means for a small business
The problem isn't Synology. It's treating the NAS like a household appliance. A device holding all of your company's documents deserves the same care as a server: patches, restricted access and someone responsible for checking it.
Note that C3RB3R doesn't rely on a single flaw. It exploits one fixed in late 2024 and, according to Qihoo 360, two more fixed this September. Patching once isn't enough; you have to keep it current. That's why automatic updates make sense for a company without its own IT team.
And the underlying lesson: if your only backup lives on the same NAS as your files, you have no backup against ransomware. A copy outside the device, out of the attacker's reach, is what decides whether an attack is a bad day or a crisis. If you're not sure how yours is set up, reviewing it is part of our cybersecurity work for small businesses.
Frequently asked questions
Is updating DSM enough?
To close the known flaws, yes, as long as you reach the latest version. But you should also take the admin interface off the internet and keep a backup outside the NAS. If you're already encrypted, updating won't recover your data.
What is the minimum DSM version I need?
For the 2024 flaws: 7.2.2-72806-1, 7.2.1-69057-6, 7.2-64570-4, 7.1.1-42962-7 or 6.2.4-25556-8, depending on your branch. To also cover the September 2026 flaws, install the latest release.
Do I have to notify the Spanish data protection authority (AEPD) if my NAS is encrypted?
If personal data is affected and the breach poses a risk to people, the GDPR requires notification within 72 hours. This is a general GDPR obligation, not something specific to this advisory.
