Synology NAS Devices Are Being Hit by Ransomware: The Storage Box in Your Office Needs an Owner Too

Synology said on October 29 that attackers are exploiting a vulnerability patched in December 2024 to target NAS devices running outdated DSM versions, encrypting data and demanding ransom. The company is urging everyone on an affected version to update DSM immediately and turn on automatic updates. According to public reports, the ransomware in this campaign is called C3RB3R and encrypted files get a .L0CK3D extension.

According to security researchers, some incidents also involve newer flaws disclosed in September, so the exact entry point is still disputed, and Synology has not published a victim count. Over the past few days, small companies have reported having all their files encrypted because the office NAS had gone unpatched for a long time.

Where small teams are exposed

Five things you can do now

• Log in to your NAS today, check the DSM version, update to the latest release and enable automatic security updates
• Close any port forwarding to the NAS and move remote access behind a VPN or zero-trust access
• Keep at least one backup that does not live on this NAS (an offline drive or separate storage), enable immutable snapshots, and test a restore
• Keep seed phrases, private keys and keystore files off the NAS and off every shared drive
• Clean up NAS accounts, disable the default admin account and require two-factor authentication for everyone

That attacks target outdated DSM through a vulnerability patched in December 2024, and the update guidance, come from Synology's official statement. The ransomware name and file extension come from public reports. The claim that some incidents involve flaws disclosed in September 2026 comes from security researchers. The victim count and the entry point for each incident have not been published. This article does not cover attack details.