C3RB3R ransomware hits Synology NAS devices: update DSM and close internet access
For many Quebec SMBs, the file server is a small black box on a shelf: a Synology NAS. It holds client files, accounting, drawings, sometimes even the computers’ backups. And since mid-October, owners of these devices have been opening their folders to find files renamed with .L0CK3D and a note called read-me3.txt.
On October 29, 2026, Synology published a rare warning: attackers are exploiting a flaw fixed in December 2024 to encrypt NAS devices still running an old version of DSM (the device’s operating system), then demand a ransom. Synology’s last warning of this kind dated back to 2019.
Synology ransomware C3RB3R: what is happening
The ransom note claims that “all your important files have been encrypted” and pushes the victim to buy a “C3rb3r Decryptor” on a dark web site, for several thousand dollars. Synology hasn’t said which flaw is being exploited. It points to its Synology-SA-24:20 advisory, which fixes three DSM flaws: one allows remote code execution (CVE-2024-10441), the other two allow reading or writing files (CVE-2024-50629 and CVE-2024-10445).
The Shadowserver organization counts more than 380,000 Synology NAS devices reachable directly from the internet. Not all of them are vulnerable, but each one is a door attackers are testing right now.
The 3 doors attackers find open
Which DSM version to install
Here are the minimum versions that fix the flaws in advisory SA-24:20. If your NAS allows it, install the very latest version available for your branch instead: it also includes more recent fixes.
| Your DSM branch | Minimum fixed version | Severity per Synology |
|---|---|---|
| DSM 7.2.2 | 7.2.2-72806-1 or later | Critical |
| DSM 7.2.1 | 7.2.1-69057-6 or later | Critical |
| DSM 7.2 | 7.2-64570-4 or later | Critical |
| DSM 7.1 | 7.1.1-42962-7 or later | Critical |
| DSM 6.2 | 6.2.4-25556-8 or later | Moderate |
To check: Control Panel › Update & Restore. The installed version is shown at the top. While you’re there, turn on automatic installation of important updates. If your device is too old to receive recent versions, that’s the signal to plan its replacement.
Protect your NAS in 4 layers
From the outside in to your files
Layer 1 · Network
No DSM page, no port 5000/5001 and no QuickConnect open to the public. Remote access over VPN only.
Layer 2 · Accounts
Default “admin” account disabled, unique passwords, two-factor authentication for every administrator, automatic blocking of addresses after several failed attempts.
Layer 3 · System
DSM and installed packages up to date, automatic updates on, unused packages removed.
Layer 4 · Data
Write-protected snapshots, plus a copy of the data offline or in another location. A NAS is not a backup on its own.
We saw it with the ransomware that encrypted backups at IDCF Cloud: when copies live in the same place as the originals, one attack can take everything. Our backup and disaster recovery service relies on a separate, tested copy.
If your NAS is encrypting right now
⏱️
Right now
Cut off, don’t erase
- Unplug the NAS’s network cable (or disable its port on the switch).
- Don’t restart or reset the device.
- Don’t delete the
read-me3.txtnote or the.L0CK3Dfiles.
⏱️
Within the hour
Assess
- Take photos of the messages and note the time.
- Check whether your snapshots and offline copy are intact, without connecting them to the affected NAS.
- Call your IT provider and your insurer.
⏱️
Within the day
Recover cleanly
- Look up the variant on No More Ransom before any decision.
- Restore onto a wiped, updated device, never onto the old one as is.
- Change every password used on the NAS.
Paying guarantees nothing: the decryption tool may not work, and you fund the next attack. If personal information is involved, Quebec’s Law 25 also requires you to assess the incident and, if it presents a risk of serious injury, notify the Commission d’accès à l’information and the people concerned.
How NeoTech can help
With our server management service, we keep your NAS up to date, close public access, and set up the VPN, two-factor authentication and snapshots. Our automated 24/7 monitoring with on-call technician intervention spots abnormal sign-ins and waves of renamed files before everything is encrypted. For all your protections, see our cybersecurity services.
Book your free cyber check
In 30 minutes, we look together at your NAS: its DSM version, what is open to the internet, and whether your backups would survive ransomware.
Call us at 438-476-2322 or email info@neotechcloudsolutions.com.
Our office: 2572 boul. Daniel-Johnson, office 237, Laval.
Sources
- Synology — Synology urges users to update DSM following ransomware attacks on outdated DSM versions, October 29, 2026
- Synology — Synology-SA-24:20 DSM (security advisory)
- BleepingComputer — Synology warns of C3RB3R ransomware attacks targeting NAS devices, November 2, 2026
- IT-Connect — C3RB3R ransomware is hitting Synology NAS devices: how to protect yours
- No More Ransom — free decryption tools (Europol and partners)
Photo: Jakub Zerdzicki, Pexels (Pexels licence).