Synology C3RB3R Ransomware: Update DSM and Lock Down Your NAS

Synology says attackers are encrypting data on Synology NAS devices that run outdated versions of DiskStation Manager (DSM), using a vulnerability the company patched in December 2024. The fix is to update DSM now (DSM 7.2.2 needs build 7.2.2-72806-1 or later; the full table is below), turn on automatic installation of important updates, and stop exposing the DSM sign-in page to the internet. Victims report a ransom note called read-me3.txt and files renamed with a .L0CK3D extension.

Below: what Synology announced, which DSM builds are vulnerable, how to update and lock down remote access, and what to do if your files are already encrypted.

What Synology announced

On October 29, 2026, Synology published a statement saying it had “identified threat actors exploiting a vulnerability patched in December 2024” against devices running outdated DSM. It urged everyone on vulnerable versions to update immediately and to enable automatic updates. The statement points to security advisory Synology-SA-24:20, first published in November 2024 after the Pwn2Own hacking contest.

BleepingComputer reported on November 2 that the first victim reports appeared more than two weeks earlier on the r/synology subreddit. Affected users found encrypted files with a .L0CK3D extension and a ransom note, read-me3.txt, that directs them to buy a “C3rb3r Decryptor” from a dark-web site for thousands of dollars. Synology rarely issues attack warnings like this; BleepingComputer notes the previous one was in August 2019, during the eCh0raix ransomware wave.

Synology has not said which of the advisory’s flaws is being used, or how many devices are affected.

Which DSM versions are vulnerable

Advisory Synology-SA-24:20 covers three CVEs: CVE-2024-10441 (rated critical, CVSS 9.8, allows remote code execution), CVE-2024-50629 (lets an attacker read certain files) and CVE-2024-10445 (lets an attacker write certain files). If your build is older than the one listed for your DSM version, you are exposed.

DSM version	Severity	Update to this build or later
DSM 7.2.2	Critical	7.2.2-72806-1
DSM 7.2.1	Critical	7.2.1-69057-6
DSM 7.2	Critical	7.2-64570-4
DSM 7.1	Critical	7.1.1-42962-7
DSM 6.2	Moderate	6.2.4-25556-8

The advisory also mentions BeeStation OS builds before 1.1-65374. If you run DSM UC or a version not in this table, check your model’s page in the Synology Download Center.

How to check your DSM version and update

1. Sign in to DSM as an administrator.
2. Open Control Panel > Update & Restore. The update page shows your current DSM version and whether an update is available.
3. If a major update is listed, click Download, then Update Now. Minor updates appear as a message next to Status. The NAS restarts when the update finishes.
4. Click Update Settings and choose Automatically install important updates. This installs fixes for security vulnerabilities without waiting for you. Automatically install the latest updates also adds feature updates within your current DSM version, but neither option moves you to a new major version.
5. If the update download fails, Synology’s help page suggests checking the NAS’s internet connection and trying again later if the download server is busy. You can also download the update file from the Download Center and use Manual DSM Update.

Synology’s help notes that on NAS models released in 2025 and later, the system checks for updates daily and installs them at a scheduled time; older models let you choose the days and time for checks.

Take the DSM sign-in page off the internet

Updating closes the known hole. Removing internet access to the DSM web interface stops the next one from being reachable. BleepingComputer’s advice is to block access to the management interface from the internet.

1. In DSM, open Control Panel > External Access > Router Configuration. This is where DSM sets up port forwarding on routers that support UPnP. Remove any rule that forwards DSM’s web ports (5000 and 5001 by default, unless you changed them) to the NAS.
2. Sign in to your router directly and check its port forwarding section as well. Rules created there do not always show up in DSM.
3. If you need remote access to your files, use a VPN to reach your home or office network first, instead of opening the DSM login to the world.
4. Turn on brute-force protection: go to Control Panel > Security > Protection > Auto Block, tick Enable auto block, and set values for Login attempts and Within (minutes). Click Apply.
5. Use a long, unique password on every admin account and turn on two-factor sign-in for them. Our guide to two-step verification for Google and Microsoft explains how authenticator codes work if you have not used them before.

If your files already end in .L0CK3D

1. Disconnect the NAS from the network by unplugging its Ethernet cable. This stops further encryption over the network. Do not wipe or reinstall it yet.
2. Do not pay as a first step. Paying does not guarantee working decryption, and law enforcement agencies including the FBI advise against it. We found no free public decryptor for C3RB3R as of November 2, 2026.
3. Check for snapshots. If you used Snapshot Replication, earlier snapshots may let you restore shared folders, provided the attacker did not delete them. We could not confirm whether this campaign removes snapshots.
4. Restore from a backup stored somewhere else, such as a USB drive you unplug after each backup or a cloud copy. A backup on the same NAS can be encrypted along with everything else.
5. Update DSM before reconnecting, and close the internet exposure described above. Otherwise the same hole stays open.
6. Report the attack to your national cybercrime agency (in the U.S., the FBI’s IC3) and contact Synology technical support.

Backups that survive NAS ransomware

A NAS often is the backup, which is why ransomware on it hurts. Keep at least one copy of important files off the NAS and offline or in a separate account. Snapshot Replication in DSM 7.2 and later can mark snapshots as immutable for a set period, which means they cannot be deleted or changed until that period ends, even by an admin account.

If your computers back up to the NAS, add a second destination. Our guides to backing up a Windows 11 PC for free and backing up a Google account with Takeout cover the basics.

FAQ

Is my Synology NAS at risk if it is only used on my home network?

The risk is much lower if the DSM interface is not reachable from the internet, because the attacks Synology describes target exposed, outdated devices. Update anyway: a single infected PC on the same network could still reach the NAS.

Does QuickConnect expose my NAS to C3RB3R?

Synology has not said which access route attackers used. Until it does, update DSM, turn on Auto Block and two-factor sign-in, and turn off remote access methods you do not use.

What is C3RB3R ransomware?

It is the name victims see in the ransom note, which offers a “C3rb3r Decryptor” for sale. Encrypted files get a .L0CK3D extension and the note is saved as read-me3.txt. Synology has not published technical details of the malware.

Will updating DSM delete my data?

No. Synology says system updates do not affect data on the NAS, but they cannot be reversed, which is why it recommends a backup before updating.

Related guides

• CVE-2026-98432: How to Check and Patch Your Linux Server
• Refrigeration Controller Hack: How to Check If Yours Is Exposed
• GitLab CVE-2026-97229: Check If Your Server Is Patched

Sources

How we checked: we read Synology’s statement and advisory, the DSM help pages for Update, Protection and Router Configuration, and BleepingComputer’s November 2 report. Menu labels come from Synology’s DSM 7 help; older DSM 6.2 menus differ.

• Synology: Synology urges users to update DSM following ransomware attacks on outdated DSM versions (October 29, 2026)
• Synology-SA-24:20 DSM (PWN2OWN 2024) security advisory (published November 2024, updated March 2025)
• Synology DSM help: Update
• Synology DSM help: Protection (Auto Block)
• BleepingComputer: Synology warns of C3RB3R ransomware attacks targeting NAS devices (November 2, 2026)

Next step: open Control Panel > Update & Restore on your NAS now and compare your build number with the table above.