Synology confirms ransomware attacks on outdated DSM and leaves the exploited flaw unnamed

Synology has confirmed an active ransomware campaign against network-attached storage devices running outdated DiskStation Manager software. In a statement dated 29 October 2026, the company said threat actors were exploiting a vulnerability patched in December 2024, with the aim of encrypting data and extorting a ransom. It urged affected users to update DSM immediately and to enable automatic updates.

The warning matters because it comes from the vendor rather than from victims alone. It also stops short of the detail needed to reconstruct the attack. Synology did not name the vulnerability, the threat actors or the number of affected devices in its statement. It pointed readers to its advisory Synology-SA-24:20.

ThaiCERT, in an advisory dated 3 November, reported that affected users had linked the activity to C3RB3R ransomware, with encrypted files receiving a .L0CK3D extension and a ransom note named read-me3.txt. BleepingComputer reported a wave of customer reports, the first of them more than two weeks before its 2 November article, and said users were prompted to buy a C3rb3r Decryptor from a dark web portal for thousands of dollars.

The flaw Synology has not named

Synology’s advisory link is the centre of the unresolved technical question. ThaiCERT reported that Synology-SA-24:20 covers three flaws: CVE-2024-10441, which could allow an attacker to execute commands on the system; CVE-2024-50629, which could allow access to certain files; and CVE-2024-10445, associated with file writing under specific conditions. Synology has not confirmed which of them, if any, was used in the C3RB3R campaign.

BleepingComputer reported that a Synology spokesperson, asked which vulnerability was being exploited, directed it back to the same 2024 advisory. That leaves the entry point unnamed. The available evidence supports calling this an active campaign exploiting an unspecified vulnerability patched in December 2024. It does not support calling the flaw a confirmed zero-day or attributing the campaign to a specific CVE.

A competing account exists. The analysis blog everyWAN reports that the 360 anti-ransomware team attributed the entry point to two flaws fixed in September 2026, and describes a response-team report of a victim running DSM 7.4.1-90080 Update 1, a build published after those fixes. Those accounts rest on second-hand description, Synology has not confirmed them and everyWAN describes its own reconciliation as unconfirmed. As described, the response-team report did not claim zero-day exploitation and did not establish whether the device was compromised before it updated.

Patch levels and their limits

ThaiCERT, citing Synology-SA-24:20, lists fixed releases as DSM 7.2.2-72806-1, DSM 7.2.1-69057-6, DSM 7.2-64570-4, DSM 7.1.1-42962-7 and DSM 6.2.4-25556-8, or later versions within the respective branches. BleepingComputer rated the DSM 7.x branches it listed as critical and DSM 6.2 as moderate.

Those are vendor patch levels for the advisory Synology linked to, not a confirmed map of the campaign’s entry point. The statement did not list exact vulnerable version ranges. That guidance does not prove every older device is vulnerable to this campaign, or that updating ends all risk. Updating remains the practical baseline because it closes the flaws named in the linked advisory and because CERTs recommend the latest supported build.

HKCERT, in its 2 November alert, relayed the warning as involving end-of-life DSM versions. It advised planning an upgrade or replacement for devices that cannot run a supported release.

One exposure figure needs care. BleepingComputer said Shadowserver tracked more than 380,000 internet-exposed Synology NAS devices, while noting that it did not say how many were secured or were honeypots. That figure is not a victim count and not a count of vulnerable machines.

C3RB3R is not a new name

The C3RB3R name has history, which complicates descriptions of the malware as new. BleepingComputer reported that Cerber, also known as C3RB3R and CerberImposter, borrowed its name from a 2016 ransomware-as-a-service operation and had previously been deployed against Atlassian Confluence and GitLab servers exploiting CVE-2021-26084, CVE-2021-22205 and CVE-2023-22518. That does not establish that the current operators are the same people or that the Synology campaign is old. It does mean the name alone does not show that the family is new.

What NAS owners should do now

Update DSM to the latest build supported by the device and enable automatic updates, as Synology, ThaiCERT and HKCERT advise. Do not expose the management interface directly to the internet. Disable unnecessary services and port forwarding, and restrict remote access to an internal network or VPN where possible.

Keep offline or immutable backups and test that restoration works. HKCERT also relayed separate PHP2Shell package updates for certain PHP-dependent packages and said Synology had not confirmed whether PHP2Shell was involved in the ransomware attacks. It advised installing the PHP security updates through Package Center for DSM 7.4, 7.3, 7.2, 7.1, 7.0 and 6.2. MailStation requires a separate manual update. HKCERT said those fixes do not mean that end-of-life DSM versions have returned to full support.

For a suspected infection, ThaiCERT and HKCERT advise isolating the device, suspending synchronisation and backup jobs, preserving ransom notes, encrypted samples and logs, and avoiding a reset or format while the scope is assessed. Restore only from verified clean backups after remediation, reset potentially compromised credentials from a clean device, and do not assume that paying a ransom will recover data. Security updates will not decrypt files that are already encrypted.

The unresolved flaw matters because it decides whether a particular build closes the route used in every case, and a confirmed victim count would show the scale of the incident. Neither changes the immediate direction for an exposed NAS. The practical steps above hold whichever account of the entry point proves correct. What remains open is which flaw the attackers used, how many devices were affected, who is behind the campaign and whether any victims were running fully updated builds.

A fixed build tells you what a vendor closed; it does not tell you which route an intruder used. Reading an advisory closely is a discipline of its own: matching a version number to the flaws it addresses, keeping an unnamed entry point unnamed, and resisting the pull of the tidiest explanation available. Cybersecurity fundamentals is where that habit is built, covering how vulnerabilities, exposures and confirmed compromises are described and kept apart. The Hack Academy’s online cybersecurity training programme lists cybersecurity fundamentals among its subject areas, with self-paced learning and practical exercises alongside the theory, for readers who would rather read a patch note properly than skim its headline. explore The Hack Academy’s online cybersecurity training programme If that sounds like the kind of grounding you want, it is a sensible place to start.