Synology has confirmed that C3RB3R ransomware is encrypting NAS devices still running outdated DSM builds, exploiting a flaw patched in December 2024. The risk is highest for businesses whose only backup is a single NAS.
Synology has confirmed an active ransomware campaign against its network-attached storage (NAS) devices. According to the company, attackers are abusing a vulnerability it patched back in December 2024 on units still running outdated DSM builds. This is not a zero-day — it is the consequence of a two-year-old hole left open.
The campaign uses a ransomware family called C3RB3R. The Hacker News reports that it appends the .L0CK3D extension to encrypted files and drops a ransom note named read-me3.txt into every affected directory. TechRadar reports that victims are being asked for thousands of dollars in exchange for the decryption key.
Which flaws, which builds
Synology did not name the specific flaw being exploited, but tied the attacks to its November 2024 advisory Synology_SA_24_20. The most serious issue in that bulletin is CVE-2024-10441, scored 9.8 on the CVSS scale and allowing remote code execution. The same advisory also covers CVE-2024-50629 (5.3) and CVE-2024-10445 (4.3). The Hacker News adds that, per Qihoo 360, C3RB3R has also exploited CVE-2026-13684 and CVE-2026-13639 — both rated CVSS 9.8 — which Synology fixed in September 2026.
Synology has not disclosed how many devices were hit, where the attacks concentrated, or who is behind them. It confirmed only that customers have reported infections, and urged "all users running vulnerable versions to update DSM immediately."
The fixed builds are: 7.2.2-72806-1 for DSM 7.2.2, 7.2.1-69057-6 for DSM 7.2.1, 7.2-64570-4 for DSM 7.2, 7.1.1-42962-7 for DSM 7.1, and 6.2.4-25556-8 for DSM 6.2. Anything older than these is considered at risk.
Why this matters for smaller businesses
For most small and mid-sized companies, the NAS is not one backup target among many — it is the only one. Project files, accounting records, camera footage and mail archives all sit in the same box. When ransomware encrypts that box, the business loses its live data and its route back at the same moment.
Two structural habits make this worse. First, NAS units are routinely exposed straight to the internet for convenient remote access; TechRadar, citing Shadowserver, notes roughly 380,000 internet-facing Synology endpoints under observation, a significant share of which are likely already patched. Second, RAID and on-device snapshots are not ransomware protection — encryption reaches both copies. And where personal data is lost, Turkey's KVKK regime brings a 72-hour breach notification duty, so the incident becomes a regulatory matter as well as an operational one.
What we recommend at Kamer Bilişim
- Check your DSM build today and move to the fixed versions above. You will find the current build under Control Panel > Update & Restore. Leave automatic updates enabled — this wave feeds on patches that exist but were never applied.
- Stop exposing the NAS directly to the internet. If remote access is required, put it behind a VPN, close the management interface to the outside world, change default ports and the admin account, and enforce two-factor authentication on administrator logins.
- Keep a copy of the backup away from the backup. Apply the 3-2-1 rule: three copies of the data, two different media, one copy independent of the device and the network (an offline disk or cloud). Above all, test restores on a schedule — an untested backup is not a backup.
We can review your office NAS and backup configuration together and tell you honestly whether it would survive this campaign. We work on site across the Anatolian side of Istanbul and remotely elsewhere. Reach us through the contact page.
Source: The Hacker News, TechRadar, Synology advisory Synology_SA_24_20
Source: The Hacker News