Threat watch / Campaign
Synology NAS: ransomware hits devices on outdated DSM
Synology says attackers are exploiting a flaw patched in December 2024 to hit NAS devices on outdated DSM versions. Files are encrypted by C3RB3R, a Cerber variant according to the Chinese security firm 360, which points to two other flaws fixed in September 2026.
- Sector
- Many sectors
- Way in
- Software flaw
- Product or vendor
- Synology DSM
- How it happened
- Synology says "threat actors" exploit "a vulnerability patched in December 2024" and refers to advisory SA-24:20 (CVE-2024-10441, remote code execution). 360 instead names CVE-2026-13639 and CVE-2026-13684, fixed in September 2026. Public reports do not settle whether both describe the same attacks.[1][2][3][4][5] Checked 7 Nov 2026
- What was stolen
- Files on the NAS are encrypted and renamed with the .L0CK3D extension, with a ransom note named read-me3.txt pointing to a Tor site. Whether data was also copied out is not public.[4][5] Checked 7 Nov 2026
- Who was impacted
- Owners of Synology NAS devices running outdated DSM versions. No source gives a victim count; IT-Connect says reports came mainly from Chinese forums.[1][4] Checked 7 Nov 2026
- Threat actor
- Not attributed
- CVE
- CVE-2024-10441, CVE-2026-13639, CVE-2026-13684
Timeline
- Synology publishes advisory SA-24:20, rated critical, including CVE-2024-10441, which lets remote attackers execute arbitrary code on DSM. [2]
- Synology publishes advisory SA-26:13, rated critical, with CVE-2026-13639 and CVE-2026-13684. The fixed builds are DSM 7.4-90075, 7.3.2-86009-4, 7.2.2-72806-9 and 7.2.1-69057-12. [3]
- Synology "strongly urges" users on vulnerable versions to update DSM immediately and to turn on automatic updates. The same day, 360 attributes the attacks to C3RB3R, a Cerber variant, and points to the SA-26:13 flaws. [1][4]
- Gridinsoft notes that Synology's notice does not name the CVE used in each attack, and that patching closes the entry point but does not unlock files already encrypted. [5]