Synology published a warning on 29 October 2026: attackers are exploiting a vulnerability the company patched in December 2024 to break into NAS drives running outdated versions of DSM, its operating system, then encrypt the data and demand a ransom. On 2 November BleepingComputer linked the attacks to the C3RB3R ransomware. Synology rarely issues this kind of alert. BleepingComputer says the previous one dates from August 2019, when brute-force attacks spread the eCh0raix ransomware.

What owners have been finding

Reports from affected users started more than two weeks before the advisory. Encrypted files get a .L0CK3D extension, and a note called read-me3.txt sends the victim to a dark web page to buy a "C3rb3r Decryptor" for thousands of dollars. The note also warns against trying third-party recovery tools.

C3RB3R, also tracked as Cerber or CerberImposter, borrows the name of a ransomware operation from 2016 that disappeared at the end of 2019. The current one has been around since December 2021 and has previously hit Atlassian Confluence and GitLab servers through known, already patched flaws.

Which bug, and which builds are safe

Synology has not said which vulnerability is being used. Its advisory points to Synology-SA-24:20, which covers flaws that let a remote attacker run arbitrary code (CVE-2024-10441), read files (CVE-2024-50629) and write files (CVE-2024-10445). The minimum fixed builds are:

  • DSM 7.2.2: 7.2.2-72806-1 or later
  • DSM 7.2.1: 7.2.1-69057-6 or later
  • DSM 7.2: 7.2-64570-4 or later
  • DSM 7.1: 7.1.1-42962-7 or later
  • DSM 6.2: 6.2.4-25556-8 or later (rated moderate rather than critical)

Those builds are only the minimum for this advisory. Synology's own advice is to update to the latest DSM version, not just past these numbers.

Why a home NAS is exposed

A home NAS often holds more than files: camera recordings, Docker containers, sometimes Home Assistant or its backups. Anyone who opened DSM to the internet for remote access and then stopped updating has had the hole open for almost two years. Shadowserver currently counts more than 380,000 Synology NAS drives reachable from the internet, though it does not say how many of them are patched.

What to do now

  • Check the DSM version in Control Panel > Info Center and update. Synology also recommends turning on automatic updates.
  • Take the DSM web interface off the internet, as BleepingComputer recommends. Remove port forwards to it from the router and reach the NAS through a VPN when away from home.
  • Keep at least one backup that the NAS itself cannot overwrite, such as an offline drive or a copy on another machine, so ransomware on the NAS cannot encrypt the backup as well.

Drives that stopped receiving DSM updates years ago should not face the internet at all.