Synology ransomware attack: check your DSM build, then your ports

The targets are Synology devices on old DSM software that can be reached from the internet. Synology hasn’t named the exact bug, but when asked, a company spokesperson pointed to a November 2024 security advisory that listed three flaws, and its own warning says the exploited one was fixed in December 2024.

The worst of those three, CVE-2024-10441, is rated 9.8 out of 10 for severity and can let an outsider run their own code on the box. The other two let attackers read or write limited files. Synology rated the problem critical on every DSM line except the old 6.2 branch, where it was labeled moderate.

How many boxes could be exposed? The Shadowserver Foundation, a group that scans the internet for risky devices, counts over 380,000 Synology NAS units reachable online. Many will already be patched, and nobody has published how many have been breached.

Synology rarely sends out warnings like this. Its last alert about active attacks on customer devices dates back to August 2019.

You’re protected against the flaws in that advisory once DSM reaches at least these builds, according to Synology’s fix list:

• DSM 7.2.2: build 7.2.2-72806-1 or later
• DSM 7.2.1: build 7.2.1-69057-6 or later
• DSM 7.2: build 7.2-64570-4 or later
• DSM 7.1: build 7.1.1-42962-7 or later
• DSM 6.2: build 6.2.4-25556-8 or later

Treat those as the floor, not the goal. Researchers don’t agree on which flaw is driving every infection. Chinese security firm Qihoo 360 says the gang has also used two DSM bugs Synology fixed in September 2026, each rated 9.8. A separate report from responders goes further and blames exposed Docker containers running GitLab or Confluence, plus PHP flaws in Synology packages such as MailStation and Synology Calendar. Synology itself asks owners to move to the latest DSM version, which covers all of the above.

The signs are hard to miss. Encrypted files get the .L0CK3D extension tacked on, and a text file named read-me3.txt appears in every folder the malware touched. The note pushes victims toward a dark web page selling a “C3rb3r Decryptor” and offers to unlock one file free as proof.

Victims have reported demands of $3,000 in Bitcoin, with the price doubling if they don’t pay within 72 hours. One Synology DS2422+ owner said 70TB of data was locked in an attack on October 29.

The code behind this is called C3RB3R (also known as Cerber or CerberImposter). It borrows the name of a notorious ransomware service from 2016, and the same strain was turned on Atlassian Confluence and GitLab servers in earlier waves. According to one analysis, it skips system folders and program files so the device keeps running while it encrypts everything else, and it reaches every mounted storage volume, not just one shared folder.

That last point matters for backups. Reports say local Hyper Backup folders on the same box get encrypted like any other file, and some victims found their snapshots and backups deleted outright. No general free decryption tool exists.

Here’s the trap that caught some owners. Synology users on Reddit reported their boxes showing a “fully updated” message even though background updates had quietly stopped, leaving them several releases behind.

One DS918+ owner traced their infection to a fix that shipped as Update 6 in November 2024; their NAS was sitting on the release before it. They didn’t lose anything, because they kept 3-2-1 backups.

Synology’s manual says devices from 2025 onward update automatically, but it’s silent on older hardware. So if your box is a few years old, don’t trust the dashboard alone. Compare your installed build against the list above, and check Synology’s support pages for the newest release for your model.

Synology’s own advice is two lines: update DSM immediately if you’re on a vulnerable version, and enable automatic updates so it stays current. Security reporters and responders add a few more steps that match how these attacks got in:

1. Hide the admin page. Block the DSM management interface from the internet. Use a VPN or a reverse proxy for remote access instead of forwarding ports on your router.
2. Trim what’s exposed. Remove port forwarding rules you don’t need and switch off DSM services and features you don’t use.
3. Run Security Advisor. Synology’s built-in checkup tool flags weak settings on the box.
4. Fix logins. Victims included owners with weak or reused passwords, so use a unique password and two-factor sign-in.
5. Back up somewhere the NAS can’t touch. Use immutable snapshots, an external drive or a cloud copy that the NAS can’t alter or erase.

Be careful with QuickConnect, Synology’s remote-access shortcut. It can be safe, but if it’s set up loosely it widens your exposure, and a VPN is the safer choice for sensitive files.

If your box hasn’t been hit but you’re worried, those responders suggest pulling the network cable, or blocking outside and local file-sharing access at the router, until it’s patched. They also suggest stopping containers and pausing Hyper Backup and Cloud Sync. If you’ve already been hit, don’t reinstall DSM or wipe the drives. Keep the ransom note, SSH logs and container logs, because they help trace the flaw and report the incident to Synology.