Ransomware is encrypting Synology storage servers left without updates

Files suddenly ending in .L0CK3D, and in every folder a ransom note named read-me3.txt signed C3RB3R. In recent days, owners of Synology NAS devices, the storage servers widely used in SMEs and by individuals, have been discovering that their data is encrypted.

On October 29, Synology confirmed the attacks in a statement. According to the Taiwanese manufacturer, the attackers are exploiting a vulnerability patched in late 2024 and targeting devices still running an outdated version of DSM, the operating system of its NAS devices. Their goal: encrypt the data and demand a ransom. Synology urges users to update DSM immediately and enable automatic updates.

Which vulnerability opens the door to the attackers?

Synology points to its advisory SA-24:20, published on November 5, 2024, after the Pwn2Own hacking contest. The most serious flaw, CVE-2024-10441, is rated 9.8 out of 10: it allows remote code execution. It is fixed starting with DSM 7.2.2-72806-1, 7.2.1-69057-6, 7.2-64570-4 and 7.1.1-42962-7.

Chinese security vendor 360 suggests another lead. In an October 29 alert, it attributes the attacks it analyzed to two more recent flaws, CVE-2026-13639 and CVE-2026-13684, which Synology patched in September (advisory SA-26:13). They are also rated 9.8 and, according to Singapore's cybersecurity agency, would let a remote attacker read or write files. At this stage, the exact entry point has not been settled.

The first affected NAS devices, including a Zyxel, appeared on October 17 on the BleepingComputer forum, according to a tally published by a Taiwanese tech blog. Reports from Synology owners followed on Reddit on October 28, at least four within twelve hours. In these accounts, snapshots were deleted and permanently connected backup drives were encrypted as well. No public decryption tool has been reported so far.

What should you do if you have a Synology NAS?

Nothing sophisticated here: devices exposed to the Internet and left on an outdated version. The measures are therefore simple.

• Check the exact DSM version, including the update number, and install at least the versions that fix both advisories: 7.4-90075, 7.3.2-86009-4, 7.2.2-72806-9 or 7.2.1-69057-12. According to the Taiwanese blog, automatic updates do not move you from one major version to the next (from 7.1 to 7.2, for example): do it manually.
• Take the NAS off the Internet: remove port forwarding on the router or modem, disable UPnP, and use a VPN for remote access.
• Protect your backups: immutable Btrfs snapshots and at least one disconnected or off-site copy. A USB drive that is permanently plugged in is not a backup against ransomware.
• If you are infected: unplug the network cable without rebooting, don't delete anything, keep the ransom note and the logs, then restore from an earlier backup. Do not pay.

Will an update be enough?

Not necessarily. The Taiwanese blog reports cases that remain unexplained, including a device running DSM 7.4.1 that is being analyzed. These accounts are unverified, but they are a reminder not to rely on the patch alone: a NAS that can no longer be reached from the Internet remains the best protection. As the SafePay ransomware, which erases backups before encrypting, has shown, attackers know where to strike to prevent a restore.

It remains to be seen which flaw is really being used. If 360's hypothesis is confirmed, devices that are up to date as of 2024 but not as of September 2026 would be exposed too.