Synology Confirms Ransomware Attacks on NAS Devices Running Outdated DSM
Attackers are targeting Synology NAS devices with outdated DSM through a vulnerability patched in December 2024. The goal is to encrypt data and demand a ransom.
Attacks on Synology NAS devices are affecting systems running outdated versions of DiskStation Manager (DSM). On October 29, the manufacturer said attackers were exploiting a vulnerability patched in December 2024 to encrypt data and subsequently demand a ransom.
Synology urged users to update DSM immediately and recommended enabling automatic updates. The manufacturer did not disclose the number of affected devices, the models involved, or technical indicators of compromise.
Synology NAS attacks are linked to an old vulnerability
The warning links to Synology security advisory Synology-SA-24:20, which was issued in connection with vulnerabilities presented at Pwn2Own 2024. The advisory lists three vulnerabilities in DSM, including the critical CVE-2024-10441, with a CVSS score of 9.8.
This vulnerability could allow remote code execution. The advisory also lists CVE-2024-50629 and CVE-2024-10445. Patches are available for the affected DSM branches, and the document does not list any temporary mitigation that would replace updating.
However, Synology has not publicly identified the specific CVE being exploited by attackers in the current campaign. The reference to the advisory therefore does not confirm that the vulnerability is CVE-2024-10441.
The risk includes encryption of data and local backups
NAS devices are often central file repositories and backup targets in homes and small businesses. If an intrusion succeeds, stored data—including local backups accessible to the attacker—could be encrypted.
According to reporting by BleepingComputer, the observed ransomware is identified as C3RB3R. Affected users reported the .L0CK3D extension on encrypted files and the ransom note read-me3.txt. Synology did not directly confirm this identification in its own announcement.
What NAS administrators should do
- Update DSM without delay to the patched release available for the specific system branch.
- Enable automatic DSM updates.
- Check whether the NAS is unnecessarily exposed to remote access from the internet and restrict such access.
- Verify the availability of backups that are not directly accessible from the NAS device.
The exploitation of devices running fully updated DSM has not been confirmed so far. More information may emerge if Synology publishes the specific exploited vulnerability, indicators of compromise, or data on the scope of the attacks. Independent security teams may also provide additional technical confirmation of the attack chain and ransomware identification.
Sources
- Synology – warning about ransomware attacks – Confirms that Synology observed exploitation of a vulnerability patched in December 2024 against outdated DSM versions and recommends immediate updating.
- Synology-SA-24:20 DSM (PWN2OWN 2024) – Lists the affected DSM branches, patched releases, and technical details about CVE-2024-10441, CVE-2024-50629, and CVE-2024-10445.
- BleepingComputer – Synology warns of C3RB3R ransomware attacks targeting NAS devices – Corresponds with Synology’s warning and provides secondary information about the ransomware identification, encrypted-file extensions, and ransom note.
Verified and updated: 11/03/2026 16:24
