Science & Tech · Cybersecurity · 2 hrs ago
Synology urges NAS users to update amid C3RB3R ransomware attacks
Synology has warned of a surge in C3RB3R ransomware attacks targeting its network-attached storage devices.
The attacks affect devices running outdated DiskStation Manager software, which controls Synology NAS systems.
The company says attackers are exploiting a vulnerability that it patched in December 2024, but has not identified the exact flaw being used.
The ransomware encrypts files and demands payment for a decryption tool; affected users say encrypted files receive a .L0CK3D ending.
Synology urges users to update their software and turn on automatic updates.
It also recommends blocking internet access to the management interface to reduce the risk of attackers reaching devices.
More than 380,000 Synology devices are exposed online, though it is not known how many remain vulnerable.
Users should update to a fixed software version and keep management pages off the public internet.
Synology warned customers of a surge in C3RB3R ransomware attacks targeting its network-attached storage devices.
The attacks exploit a vulnerability patched in December 2024 to target devices running outdated DiskStation Manager software.
The ransomware encrypts data and demands payment for a decryption tool.
Synology urged users to update DSM, enable automatic updates and block internet access to the management web interface.
Shadowserver tracks more than 380,000 Synology NAS devices exposed to the internet.
- Who
- Synology NAS users are being targeted by threat actors.
- What
- C3RB3R ransomware attacks encrypt data and demand ransom. Synology urged users to update their devices.
- When
- The warning was reported on November 2, 2026. The first customer reports surfaced more than two weeks earlier.
- Where
- On Synology network-attached storage devices exposed to the internet.
- Why
- Attackers exploit a vulnerability patched in December 2024 to encrypt data and extort ransom.
This story does not have two clearly opposing sides.
Synology patched vulnerabilities that the attackers are now exploiting.
The first reports surfaced from Synology customers whose data had been encrypted.
Synology issued an advisory warning about attacks against its devices.
BleepingComputer reported Synology’s warning and advice to update DSM and block internet access to the management web interface.
- Ransomware
- C3RB3R
- Software targeted
- Outdated DiskStation Manager (DSM)
- File extension
- .L0CK3D
- Internet-exposed devices
- More than 380,000 Synology NAS devices
- Reported advisory date
- November 2, 2026
3 sources
What people are saying
Synology strongly urges all users running vulnerable versions to update DSM immediately to protect their systems. Synology also recommends enabling automatic updates to keep DSM up to date at all times.
The only way to decrypt your files safely is to buy the special decryption software 'C3rb3r Decryptor'