In a press release dated Oct 29, Synology said it "has identified threat actors exploiting a vulnerability patched in December 2024 to target devices running outdated versions of DSM" to encrypt data and extort a ransom. It told users to update DSM immediately and enable automatic updates, and linked Synology-SA-24:20, which covers CVE-2024-10441 (code execution), CVE-2024-50629 (file read) and CVE-2024-10445 (file write). Synology does not say which of them, if any, is the one being used. HKCERT issued a ransomware alert on Nov 2 repeating the guidance.

• What victims see: files renamed with a .L0CK3D extension and a read-me3.txt note telling them to buy the "C3rb3r Decryptor" (BleepingComputer, from victim reports going back more than two weeks).
• Competing root-cause claims: some third-party write-ups (citing 360's anti-ransomware team) link the campaign to CVE-2026-13639 and CVE-2026-13684, fixed in Synology-SA-26:13 on Sept 18. Synology's own statement points to the 2024 advisory instead, so treat the exact entry point as unconfirmed and patch both.

What to do: update every DSM box to the newest build its model supports (at least the SA-26:13 fixed releases: 7.4-90075, 7.3.2-86009-4, 7.2.2-72806-9 or 7.2.1-69057-12), turn on automatic updates, remove router port forwards to DSM's management ports and use a VPN instead, disable the default admin account, enable two-step sign-in, and keep immutable snapshots plus one offline backup. Devices stuck on end-of-life DSM should be replaced. If you find .L0CK3D files, disconnect the NAS, keep the logs and note, and restore only from a clean backup after rebuilding.