In October 2026, Synology NAS devices running outdated DiskStation Manager (DSM) versions were targeted by C3RB3R ransomware. The ransomware encrypts user files, appending a .L0CK3D extension, and leaves ransom notes demanding payment for decryption. The attack exploits a critical unauthenticated remote code execution vulnerability fixed in December 2024 (likely CVE-2024-10441) and possibly other critical vulnerabilities patched in September 2026. Infection requires only that the NAS be accessible over the internet or local network and not updated. Users are advised to disconnect infected devices from networks and update DSM immediately to mitigate risk.