Synology warns of C3RB3R ransomware hitting outdated NAS devices

Synology has warned customers of a surge in C3RB3R ransomware attacks against its network-attached storage (NAS) devices, BleepingComputer reported on 2 November 2026. In an advisory, the company said threat actors are exploiting a vulnerability patched in December 2024 to target devices running outdated versions of its DiskStation Manager (DSM) software, encrypting data and demanding a ransom.

Synology has not said which vulnerability is exploited, but it linked to a November 2024 advisory on flaws that allow code execution and reading and writing files on unpatched devices. Affected users report encrypted files with a .L0CK3D extension and a ransom note telling them to buy a C3rb3r Decryptor from a dark web portal, for thousands of dollars.

BleepingComputer notes that Synology rarely issues such warnings, the last one dating from August 2019, and that Shadowserver tracks more than 380,000 internet-exposed Synology NAS devices. Synology recommends updating DSM immediately and enabling automatic updates; the outlet also suggests blocking internet access to the management interface.

Why it matters The flaw has had a patch for almost two years, and attackers are still finding devices that never received it. Storage appliances can hold backups, so a NAS left exposed with old software can turn an extortion attempt into the loss of the recovery copy as well.