C3RB3R attacks Synology NAS: how to protect your files | Kaspersky official blog
Source Kaspersky Security Blog
Mentioned vulnerabilities
Rated High by Threat Radar's AI analysis
Data as of 9 Nov 2026, 17:34 UTC
What to do
AI-suggested
Synology has released patches fixing the exploited vulnerabilities: CVE-2024-10441 was fixed in December 2024, and CVE-2026-13639 and CVE-2026-13684 were patched in the September 2026 DSM update. Users should immediately disconnect their NAS devices from the internet and local networks if infected or if updates are pending. Manual updates should be applied in an isolated environment to ensure complete remediation. Until patched, NAS devices remain vulnerable to remote exploitation. Disabling network access and ensuring automatic updates are enabled can prevent infection. Synology also released urgent updates addressing related PHP vulnerabilities in DSM and associated applications.
Description
In October 2026, Synology NAS devices running outdated DiskStation Manager (DSM) versions were targeted by C3RB3R ransomware. The ransomware encrypts user files, appending a .L0CK3D extension, and leaves ransom notes demanding payment for decryption. The attack exploits a critical unauthenticated remote code execution vulnerability fixed in December 2024 (likely CVE-2024-10441) and possibly other critical vulnerabilities patched in September 2026. Infection requires only that the NAS be accessible over the internet or local network and not updated. Users are advised to disconnect infected devices from networks and update DSM immediately to mitigate risk.