Last checked . Picks are based on the prices, rates, fees and terms each provider publishes, checked at the source. We never rank products by commission. See how we’re funded.
Synology NAS ransomware attacks are hitting devices that run outdated versions of DSM, the operating system on Synology network storage, according to a warning reported by BleepingComputer. The malware, called C3RB3R, encrypts files and renames them with a .L0CK3D extension. Synology urges owners of vulnerable versions to update DSM immediately. Reports disagree on exactly which flaw the attackers use, so this guide separates what is confirmed from what is disputed and lists the steps that apply either way.
What Synology has said about the NAS ransomware attacks
BleepingComputer reports that Synology said threat actors are exploiting a vulnerability patched in December 2024 on devices running outdated DSM versions. Synology pointed customers to an advisory numbered Synology-SA-24:20, which covers three flaws: CVE-2024-10441, which allows arbitrary code execution, CVE-2024-50629, which allows file reads, and CVE-2024-10445, which allows file writes. BleepingComputer notes that the advisory dates from November 2024, and that Synology has not named which flaw the attackers use.
Synology’s recommendations, as reported, are to update DSM to a fixed version, enable automatic updates and block access to the management web interface from the internet. TechRadar repeats those steps and adds that the first reports surfaced more than two weeks before its article, and that Shadowserver tracks about 380,000 internet-connected endpoints, many of which are likely already patched. The Synology NAS ransomware campaign is described as ongoing, so the update advice applies now and not after more details emerge.
Fixed DSM versions for the Synology NAS ransomware flaws
BleepingComputer lists these minimum fixed releases from the November 2024 advisory. The table is a summary of that report and not a substitute for Synology’s own advisory.
| DSM branch | Severity | Minimum fixed version |
|---|---|---|
| 7.2.2 | Critical | 7.2.2-72806-1 or above |
| 7.2.1 | Critical | 7.2.1-69057-6 or above |
| 7.2 | Critical | 7.2-64570-4 or above |
| 7.1 | Critical | 7.1.1-42962-7 or above |
| 6.2 | Moderate | 6.2.4-25556-8 or above |
These are minimums for the Synology NAS ransomware flaws in the 2024 advisory. A device on a fixed version from this table may still need later updates, which is why the automatic update setting matters.
Where the reports on the Synology NAS ransomware entry point disagree
GridinSoft describes a second line of reporting. It says the security firm 360 investigated incidents involving CVE-2026-13639 and CVE-2026-13684, which Synology disclosed in September under advisory Synology-SA-26:13 and described as login-logic and SCGI flaws that let remote attackers read or write arbitrary files. The two accounts point to different vulnerabilities, and the public reports do not establish whether they cover the same victims or the same entry route.
The disagreement does not prove a zero-day or an attack on a fully patched system. It does mean a NAS that carries only the 2024 fixes may need the 2026 fixes as well. GridinSoft lists these minimums from the September advisory:
| DSM branch | Minimum version per advisory SA-26:13 |
|---|---|
| 7.4 | 7.4-90075 or later |
| 7.3 | 7.3.2-86009-4 or later |
| 7.2.2 | 7.2.2-72806-9 or later |
| 7.2.1 | 7.2.1-69057-12 or later |
GridinSoft warns that a version missing from this table is not automatically safe, because older branches are covered separately. The practical reading is that the newest available update for the installed branch is the target, and Synology’s advisory pages list it.
The two tables for the Synology NAS ransomware flaws can be read together. On the 7.2.2 and 7.2.1 branches, the 2026 minimums carry higher revision numbers than the 2024 ones, so a device that meets the 2026 figure also meets the 2024 figure on the same branch. The 7.2, 7.1 and 6.2 branches appear only in the 2024 table in these reports, and the 7.4 and 7.3 branches appear only in the 2026 table.
What the C3RB3R Synology NAS ransomware does
BleepingComputer reports that victims’ files are encrypted and renamed with the .L0CK3D extension, and that a note named read-me3.txt demands payment for a “C3rb3r Decryptor,” reportedly for thousands of dollars. The malware is linked to the Cerber ransomware family. GridinSoft, citing 360, adds that it scans directories recursively, skips 27 system directories and some executable and script types, and uses a per-file key and nonce. Renaming the files back does not reverse the encryption, so the Synology NAS ransomware leaves restoring from backup as the main recovery path.
Steps against Synology NAS ransomware before an infection
The steps below combine Synology’s reported advice with GridinSoft’s guidance:
- Update DSM to the latest version available for the installed branch, and turn on automatic updates.
- Review package updates alongside the DSM update.
- Block the DSM management interface from direct internet access, and use a VPN for remote access.
- Keep a backup that is not stored only on the same NAS.
TechRadar adds that RAID and built-in backup features do not necessarily protect against ransomware encryption. A copy stored on the same compromised device is not an independent safeguard, in GridinSoft’s words, even if it is always connected.
Steps after Synology NAS ransomware signs appear
GridinSoft’s guidance for an affected device begins with isolation. The device should come off the network first. Powering it down is a last resort when isolation is impossible, since shutdown destroys volatile evidence. Before any reset or rebuild, the owner should preserve the ransom note, sample files, the DSM version, the package list and logs, and should contact Synology Support or an incident responder.
Recovery depends on backups. GridinSoft advises confirming whether backups or snapshots predate the attack and are intact, and restoring only into a clean environment after the entry point is understood. Patching does not decrypt files, and a Windows antivirus scan cannot recover NAS data. The report treats the attackers’ claims about recovery as sales material and advises against assuming a paid decryptor will work.
Related security updates
The Jolt Journal’s guide to how to update Chrome shows the same logic on a browser, where a patch protects only after installation. Its report on Tailscale SSH security issues covers another case where administrators have to act on remote access, and its coverage of the PHP2Shell emergency patches covers a third. Each follows the pattern behind Synology NAS ransomware: the fix exists, and the risk falls on devices that have not received it.
Editor’s take
The Synology NAS ransomware reports agree on the main instruction and disagree on the details. Update DSM, enable automatic updates and keep the management interface off the open internet. Those steps hold whether the entry point is the 2024 flaw Synology cites or the 2026 flaws 360 describes. The unresolved question is which flaw the attackers actually use, and owners should not wait for the answer before updating. A NAS that holds the only copy of important files is the highest-risk case, because a backup on the same device does not protect against this kind of attack.
This is general information, not security advice. Synology’s advisories and support team have the final word on fixed versions and recovery.
