Ransomware Is Targeting Synology NAS Devices: Update DSM Now

On October 29, 2026, Synology warned that attackers are targeting its network storage devices (NAS) that run outdated versions of its DiskStation Manager (DSM) software, encrypting the data and demanding a ransom. Synology is urging everyone on an older version to update right away and to turn on automatic updates.

Many small and mid-size businesses keep shared files, and often their backups, on a Synology NAS. That is what makes this worth a few minutes of attention this week.

The short version: update DSM to the latest version for your model, make sure the NAS is not directly reachable from the internet, and keep at least one backup copy somewhere the NAS cannot write to.

What is happening

Synology says the attackers are exploiting a vulnerability it patched in December 2024 and points customers to its advisory Synology-SA-24:20. That advisory covers a critical flaw (CVE-2024-10441) that lets a remote attacker run code on the device without signing in.

Separately, the security company 360 says it has handled multiple ransomware cases on Synology NAS devices since early October. It identifies the ransomware as C3RB3R, a variant of the long-running Cerber family, and attributes the break-ins to two critical flaws that Synology fixed on September 18, 2026 in advisory Synology-SA-26:13 (CVE-2026-13639 and CVE-2026-13684). Synology rates both 9.8 out of 10 and says they let a remote attacker read or write files on the device.

The two reports point to different flaws, and it is not yet clear which one was used in each case. The practical answer is the same either way: a NAS that is fully up to date is protected against both.

Who is at risk

Any Synology NAS that has not been updated recently, especially one that can be reached from the internet. Forgotten units at branch offices, home offices and in storage closets are the most likely to be behind. According to 360, encrypted files get the extension .L0CK3D and a ransom note named read-me3.txt is left in each folder.

What to do this week

1. Update DSM. In DSM, open Control Panel, then Update & Restore, and install the latest version available for your model. For the newest versions, the fixed releases listed in Synology-SA-26:13 are DSM 7.4-90075, 7.3.2-86009-4, 7.2.2-72806-9 and 7.2.1-69057-12 or later. Then turn on automatic updates.
2. Take the NAS off the open internet. Remove router port forwards to the NAS management pages. For remote access, use a VPN or Synology's own relay service, and limit the NAS firewall to trusted addresses.
3. Lock down sign-ins. Disable the default admin account, use strong passwords, and turn on two-step verification and automatic IP blocking.
4. Protect your backups. Turn on shared folder snapshots with tamper protection, and keep at least one backup copy that is disconnected from the NAS between backups. If the NAS is your only backup, ransomware that reaches it can reach your backup too.
5. If you see .L0CK3D files or a read-me3.txt note, disconnect the NAS from the network, do not pay, and get help before rebooting or reinstalling. Updating the software does not decrypt files that were already encrypted.

Questions to ask your IT provider

1. What DSM version are our Synology devices on, and are automatic updates turned on?
2. Can anyone reach our NAS from the internet, and if so, why?
3. Do we have a backup copy the NAS itself cannot change or delete, and when did we last test a restore?