Synology NAS Ransomware: A Two-Year-Old Bug Is Still Locking Up Devices

Synology NAS ransomware is back in the news. On 29 October 2026, Synology told customers that attackers are encrypting devices that run outdated versions of its DiskStation Manager (DSM) software. The flaw they are using is not new. It was fixed in 2024, which means every victim had a patch available for around two years.

What Synology has confirmed

Synology says it has seen threat actors exploit a vulnerability patched in 2024 against devices on old DSM releases. The aim is to encrypt data and demand a ransom. The company “strongly urges all users running vulnerable versions to update DSM immediately” and recommends switching on automatic updates.

The advisory behind the warning is Synology-SA-24:20. It was published on 5 November 2024 and covers three flaws found during Pwn2Own 2024. The serious one is CVE-2024-10441, scored 9.8 out of 10. It sits in the system plugin daemon and allows remote code execution. In plain terms, an attacker can run commands on the box from the network.

The advisory lists no workaround, so this wave of Synology NAS ransomware has one answer. The only fix is the update.

Who is behind the Synology NAS ransomware

Synology’s own notice does not name the ransomware. The Chinese security firm Qihoo 360 does. Its bulletin of 29 October blames C3RB3R, described as a variant of the long-running Cerber family. According to IT-Connect, which summarised the bulletin, 360 began receiving help requests from Synology owners in early October.

The Hacker News reports the telltale signs. Encrypted files gain a .L0CK3D extension, and a note called read-me3.txt appears in each folder. The malware skips system file types so the device keeps running long enough to show the ransom demand.

These details come from 360 and the press, not from Synology. Treat the family name as well supported, but not officially confirmed by the vendor.

Why a two-year-old bug still works

Two things made this wave possible. IT-Connect reports that a public proof-of-concept for CVE-2024-10441 appeared on GitHub a few days before the Synology warning. It shows how the username field on the DSM login page can feed values into a root-level process. Once a working recipe is public, scanning for old boxes is cheap, and Synology NAS ransomware crews have every reason to do it.

The second factor is habit. A NAS is the sort of device that gets installed once and forgotten. It sits in a cupboard, holds the shared drive and the backups, and nobody owns its updates. If the web interface is also reachable from the internet, because someone opened a port for remote access years ago, it is an easy target.

We describe this pattern in our piece on internet-exposed edge devices. The weakness is rarely clever. It is an old device nobody is responsible for.

More flaws behind the Synology NAS ransomware wave

360 also says C3RB3R has a long record against network storage. It links the current wave to two further DSM flaws fixed in September 2026 under advisory SA-26:13: CVE-2026-13684 and CVE-2026-13639, both rated 9.8. Even a box patched against the 2024 bug may therefore be behind on this year’s fixes.

Check the DSM version against Synology’s current advisories, not against the list from 2024. For the 2024 flaw, the fixed builds are:

• DSM 7.2.2: 7.2.2-72806-1 or later
• DSM 7.2.1: 7.2.1-69057-6 or later
• DSM 7.2: 7.2-64570-4 or later
• DSM 7.1: 7.1.1-42962-7 or later
• DSM 6.2: 6.2.4-25556-8 or later

How to defend against Synology NAS ransomware this week

Start with exposure, because it decides whether anyone can reach the bug at all.

1. Find every NAS you own. Include the one in the branch office and the one the previous IT contractor installed.
2. Take the management page off the internet. Remove port forwards to DSM and use a VPN for remote access.
3. Update DSM now, then turn on automatic updates. If a model no longer receives updates, plan its replacement.
4. Tighten accounts. Disable the default admin account, enable two-factor authentication and switch on automatic IP blocking.
5. Fix the backups. Use write-protected snapshots and keep at least one copy offline. RAID is not a backup, and a NAS that holds its own only backup will be encrypted with everything else.

If files are already encrypted, disconnect the device from the network and follow our guide on what to do after a ransomware attack.

What a penetration test adds

Patching fixes the bugs you know about. A test finds the devices you forgot you had. An external network penetration test looks at your business the way an attacker does, from the internet, and lists every service that answers. A forgotten storage login page tends to show up within the first hour.

The lesson is dull but useful. This ransomware needed no zero-day. The patch was free, it was two years old, and the attackers still got in.