Threat Actors Launch Ransomware Campaigns Against Synology Devices Using Patched DSM Weakness

Synology has issued an urgent advisory encouraging users to update the DiskStation Manager (DSM) operating system on its Network Attached Storage (NAS) devices after discovering that cybercriminals are actively exploiting outdated installations in ransomware campaigns.

According to the Taiwanese storage vendor, threat actors are taking advantage of a security vulnerability that was fixed in December 2024, specifically targeting NAS appliances that have not been updated with the latest DSM security patches.

The attacks are designed to encrypt victims' files and demand payment in exchange for restoring access, highlighting the ongoing risks facing organizations and individuals that leave storage devices exposed with outdated software.

Vulnerabilities Linked to the Attacks

Although Synology has not publicly confirmed which vulnerability is being exploited in the current ransomware wave, the company referenced a security bulletin issued in November 2024 that detailed three noteworthy DSM flaws.

Among them was CVE-2024-10441, a critical vulnerability with a CVSS score of 9.8. The flaw stemmed from improper output encoding within DSM's system plugin daemon and could potentially enable remote code execution.

The advisory also included CVE-2024-50629, a medium-severity vulnerability (CVSS 5.3) affecting the DSM WebAPI component. Successful exploitation could allow attackers to access limited files stored on vulnerable systems.

A third flaw, CVE-2024-10445 (CVSS 4.3), involved insufficient certificate validation during DSM update processes, creating an opportunity for attackers to write a limited number of files on affected devices.

To mitigate these vulnerabilities, Synology released patched versions across multiple DSM branches. Users running DSM 7.2.2, 7.2.1, 7.2, 7.1, and 6.2 were advised to upgrade to the latest supported releases that contain the security fixes.

C3RB3R Ransomware Emerges as Primary Threat

The warning follows numerous reports from customers whose NAS systems were compromised by the C3RB3R ransomware family.

Victims have reported seeing their files renamed with the extension “.L0CK3D”, rendering documents, backups, photos, and other stored data inaccessible.

Research published by Qihoo 360 Internet Security Center indicates that C3RB3R has been targeting NAS devices for an extended period, making it one of the more persistent threats facing network-attached storage environments.

Researchers linked recent attack activity to the exploitation of two additional vulnerabilities in DSM that were patched by Synology in September 2026:

• CVE-2026-13684 (CVSS 9.8), an SCGI-related vulnerability that could allow attackers to read and write arbitrary files as well as launch denial-of-service attacks.
• CVE-2026-13639 (CVSS 9.8), an authentication weakness involving insufficient entropy in the login process that could similarly be abused for unauthorized file access and service disruption.

How the C3RB3R Malware Operates

Once deployed on a vulnerable NAS device, C3RB3R begins a systematic search for files to encrypt.

To maintain system stability and maximize the effectiveness of the attack, the malware deliberately avoids certain system-critical locations. Researchers observed it excluding 27 directories as well as a range of file extensions commonly associated with operating system components and application binaries.

Examples of excluded file types include:

• BAT
• DLL
• EXE
• LNK
• MOD
• MSI
• SYS

By avoiding these files, the ransomware reduces the likelihood of crashing the operating environment before encryption is completed.

Encrypted files are appended with the .L0CK3D extension, while a ransom demand titled “read-me3.txt” is placed inside each affected directory, providing victims with instructions for contacting the attackers and making payment.

NAS Devices Remain Attractive Ransomware Targets

The latest attacks represent only the newest chapter in a growing history of ransomware campaigns directed at NAS platforms.

In 2019, attackers behind the QNAPCrypt (eCh0raix) ransomware operation successfully compromised NAS devices manufactured by QNAP Systems, encrypting user data and demanding payment for recovery.

The trend continued in August 2021, when Synology warned users of widespread password-guessing attacks linked to malware known as StealthWorker.

At the time, attackers leveraged previously infected devices to systematically brute-force administrator credentials against internet-exposed NAS systems. Once valid credentials were discovered, threat actors deployed additional malware, including ransomware payloads.

Synology explained that infected NAS devices could subsequently be used to launch attacks against other Linux-based systems, creating a self-propagating ecosystem of compromised storage appliances.

During the same period, researchers from Palo Alto Networks Unit 42 revealed that variants of eCh0raix were targeting both QNAP and Synology products.

Those attacks relied on either exploiting known vulnerabilities such as CVE-2021-28799 or simply abusing weak administrator passwords commonly left unchanged by users.

Synology's Recommendations

In response to the ongoing ransomware activity, Synology is strongly advising customers running vulnerable DSM versions to apply security updates immediately.

The company also recommends enabling automatic updates wherever possible to ensure systems receive future security patches without delay.

Beyond patching, organizations should consider additional defensive measures, including:

• Restricting internet exposure of NAS management interfaces.
• Enabling multi-factor authentication (MFA) for administrator accounts.
• Using strong, unique administrative passwords.
• Monitoring DSM login activity for suspicious behavior.
• Maintaining offline or immutable backups that cannot be encrypted by ransomware.
• Regularly auditing user accounts and permissions.

As ransomware operators increasingly focus on network storage appliances that often contain an organization's most valuable data, keeping DSM fully updated remains one of the most effective defenses against compromise.