Network-attached storage boxes made by Synology are being hit by a new wave of ransomware attacks, and the entry point behind them is not a mysterious zero-day. According to reports published by the 360 Security Team and the Solar Emergency Response Team on October 29, 2026, attackers are reaching back to vulnerabilities in Synology’s DiskStation Manager (DSM) operating system that were originally disclosed more than two years ago, following Pwn2Own 2024.

Victims have been discovering their files renamed with a .L0CK3D extension alongside a ransom note called read-me3.txt. Investigators have provisionally attributed the campaign to a strain they are calling C3RB3R. So far there is no public figure for how many devices have actually been compromised, and researchers have not confirmed whether attackers are chaining multiple flaws together or relying on just one weak point per intrusion.

A Patch That’s Been Available Since 2024

The vulnerabilities being exploited trace back to Synology’s security advisory Synology-SA-24:20, first published on November 5, 2024, and updated several times as fixes rolled out across different DSM branches. Among the issues it covers is CVE-2024-10441, a critical flaw rated 9.8 on the CVSS scale that allows unauthenticated remote code execution with no user interaction required — about as severe as a vulnerability can get.

The advisory also documents two lower-severity bugs:

• CVE-2024-50629, a flaw in DSM’s web API that lets a remote attacker read a limited set of files, rated 5.3.
• CVE-2024-10445, an update-related certificate validation issue that allows an attacker already on the network to write a restricted set of files, rated 4.3.

Fixed firmware releases have been available for DSM versions going back to 6.2.4, meaning any device still running an older build has effectively been exposed to a known, documented attack path for roughly two years. One early report noted a compromised device running DSM 7.4.1-90080 Update 1, a comparatively recent build, which briefly raised concern that an undisclosed vulnerability might be involved — but later analysis pointed investigators back toward the older, already-patched issues rather than a new flaw.

Not Synology’s First Ransomware Problem

This isn’t the first time Synology’s storage lineup has found itself in ransomware operators’ crosshairs. Earlier campaigns against DiskStation devices have previously been documented and, in at least one case, disrupted by security researchers. That history doesn’t establish any direct link to C3RB3R, but it does underline a pattern: NAS devices sitting on the open internet, often managed by small businesses or home users without a dedicated IT team, are a recurring soft target for ransomware crews looking for easy, repeatable wins.

Appinn’s incident write-up, cited by multiple outlets covering the campaign, lays out a fairly standard hardening checklist for administrators who want to avoid becoming the next victim:

• Remove direct internet exposure for DSM’s management interface and SSH access.
• Use a VPN for any remote administration rather than port-forwarding management ports.
• Enable two-factor authentication on all administrative accounts.
• Review account lists, login history, and scheduled tasks for anything unfamiliar.
• Maintain offline or off-site backups that ransomware on the live device can’t reach.

Patching Alone Won’t Undo the Damage

Synology’s published list of fixed releases includes DSM 7.2.2-72806-1, 7.2.1-69057-6, 7.2-64570-4, 7.1.1-42962-7, and 6.2.4-25556-8, among others. The company is advising administrators to move to the newest release their hardware model supports, and to make sure bundled packages and third-party add-ons are current as well — attackers frequently use outdated packages as a side door even when the core OS has been patched.

It’s worth being clear-eyed about what updating does and doesn’t accomplish at this stage. Installing the latest DSM build closes the hole that let attackers in, but it does nothing to decrypt files that have already been locked. For anyone currently staring at a drive full of .L0CK3D files, the realistic paths to recovery are an offline backup taken before the intrusion, or — in the less common cases where researchers have cracked a particular ransomware family’s encryption — a public decryption tool. No such tool has been confirmed for C3RB3R as of this writing.

The broader lesson tracks with nearly every mass-exploitation ransomware wave of the past several years: the vulnerability isn’t new, a fix has existed for a long time, and the victims are overwhelmingly devices that were never updated or that were left reachable directly from the internet. Synology customers who haven’t checked their DSM version recently would be well served to do so today, rather than after finding a ransom note in their file browser.