// AI threat desk · 4 Nov 2026
Home/CVE · Vulns & Patches
Vulns & PatchesCriticalNASCVSS 9.8; 5.3; 4.3; 9.8; 9.8

Synology DSM flaw exploited to encrypt data and extort ransom

Threat actors are exploiting a flaw fixed in December 2024 against outdated Synology DSM devices, the vendor said on Oct 29, 2026. Synology said the attacks aim to encrypt data and extort ransom.

· 1 min read
AI-generated image of hands inspecting a network storage device and disconnected backup drive in a dim office.
AI-generated image, not a photo of the event.
Key takeaways
  • Threat actors were exploiting a vulnerability patched in December 2024 against outdated DSM devices.
  • Synology said the attacks aim to encrypt data and extort ransom.

Synology said on Oct 29, 2026, that threat actors were exploiting a vulnerability patched in December 2024 against devices running outdated versions of its DiskStation Manager operating system.

Synology said the attacks aim to encrypt data and extort ransom.

On this page

C3RB3R ransomware locks files and leaves ransom notes

The Hacker News said customers reported that C3RB3R ransomware locked files with a .L0CK3D extension. It also said the malware dropped a ransom note named read-me3.txt in each encrypted directory.

The Hacker News said C3RB3R scanned files on compromised devices while skipping 27 directories and certain extensions.

Synology lists upgrade levels for DSM branches

For DSM 7.2.2, Synology listed 7.2.2-72806-1 or above. For DSM 7.2.1, it listed 7.2.1-69057-6 or above.

DSM branchUpgrade level
DSM 7.2.27.2.2-72806-1 or above
DSM 7.2.17.2.1-69057-6 or above
DSM 7.27.2-64570-4 or above
DSM 7.17.1.1-42962-7 or above
DSM 6.26.2.4-25556-8 or above

Unit 42 reported earlier NAS ransomware activity

Unit 42 said researchers found a 2021 eCh0raix variant targeting both Synology and QNAP NAS devices. Its report, published on Aug 10, 2021, said some 250,000 QNAP and Synology NAS devices were exposed to the public internet at that time.

Synology urged users running vulnerable versions to update DSM and recommended enabling automatic updates to keep the software current.

What to do now

  1. Update DSM immediately to protect your systems.
  2. Enable automatic updates to keep DSM up to date at all times.

FAQ

What happened to Synology DSM devices?

Synology said threat actors were exploiting a vulnerability patched in December 2024 against devices running outdated DSM versions.

What can the Synology attacks do?

Synology said the attacks aim to encrypt data and extort ransom.

Which Synology DSM versions have listed upgrade levels?

Synology listed upgrade levels for DSM 7.2.2, 7.2.1, 7.2, 7.1 and 6.2.

What is C3RB3R ransomware?

The Hacker News said C3RB3R ransomware locked users’ files with a .L0CK3D extension and dropped a ransom note named read-me3.txt in each encrypted directory.

Did Synology recommend automatic updates?

Yes. Synology recommended enabling automatic updates to keep DSM up to date at all times.

Sources

  1. New eCh0raix Ransomware Variant Targets QNAP and Synology Network-Attached Storage Devices, Unit 42Primary
  2. Synology urges users to update DSM following ransomware attacks on outdated DSM versionsSynology Inc., SynologyPrimary
  3. Synology NAS Devices Targeted in Ransomware Attacks Exploiting Patched DSM Flaw, The Hacker News
  4. Synology warns of C3RB3R ransomware attacks targeting NAS devices, BleepingComputer
How we checked this story
ClaimSourceStatus
Synology said it observed threat actors exploiting a vulnerability patched in December 2024 against devices running outdated DSM versions.Synology, via The Hacker NewsAttributed
Synology said the attacks aim to encrypt data and extort ransom.SynologyConfirmed
BleepingComputer reported that Synology warned customers to update their devices immediately because of a surge in C3RB3r ransomware attacks.Synology, via BleepingComputerAttributed
The Hacker News said synology listed CVE-2024-10441 with a CVSS score of 9.8.The Hacker NewsAttributed
The Hacker News said synology listed CVE-2024-50629 with a CVSS score of 5.3.The Hacker NewsAttributed
The Hacker News said synology listed CVE-2024-10445 with a CVSS score of 4.3.The Hacker NewsAttributed
Qihoo 360 listed CVE-2026-13684 with a CVSS score of 9.8.Qihoo 360 Internet Security Center, via The Hacker NewsAttributed
Qihoo 360 listed CVE-2026-13639 with a CVSS score of 9.8.Qihoo 360 Internet Security Center, via The Hacker NewsAttributed
Synology addressed the listed issues in DSM 7.2.2-72806-1 or above.Synology, via The Hacker NewsAttributed
Synology addressed the listed issues in DSM 7.2.1-69057-6 or above.Synology, via The Hacker NewsAttributed
Synology addressed the listed issues in DSM 7.2-64570-4 or above.Synology, via The Hacker NewsAttributed
Synology addressed the listed issues in DSM 7.1.1-42962-7 or above.Synology, via The Hacker NewsAttributed
Synology addressed the listed issues in DSM 6.2.4-25556-8 or above.Synology, via The Hacker NewsAttributed
The Hacker News said customers reported that C3RB3R ransomware locked files with a .L0CK3D extension.The Hacker NewsAttributed
The Hacker News said c3RB3R drops a ransom note named read-me3.txt in each encrypted directory.The Hacker NewsAttributed
Unit 42 reported a 2021 eCh0raix variant targeting both Synology and QNAP NAS devices.Unit 42Attributed
Unit 42 reported that about 250,000 QNAP and Synology NAS devices were exposed to the public internet in 2021.Unit 42Attributed
unit42.paloaltonetworks.com published its report on Aug 10, 2021.unit42.paloaltonetworks.comConfirmed

Could not verify

  • Whether the attacks exploited CVE-2024-10441, CVE-2024-50629, CVE-2024-10445, CVE-2026-13684 or CVE-2026-13639 is not established
  • How many Synology devices were compromised is not established
  • Whether the attacks exploited a vulnerability other than those listed by Synology is not established
See all in Vulns & Patches →
Explore with AI
ChatGPT
Claude
Perplexity
Grok