---
title: Synology: ransomware gangs are exploiting an old, patched DSM flaw to encrypt NAS boxes running outdated DiskStation Manager; victims see .L0CK3D files and a read-me3.txt 'C3rb3r Decryptor' note | ctxsec
url: https://ctxsec.com/items/synology-c3rb3r-ransomware-outdated-dsm-oct-29
description: "Synology said on Oct 29 that attackers are exploiting a vulnerability patched in December 2024 to encrypt data on NAS devices running outdated DSM, and urged everyone to update and turn on automatic updates. It points to advisory Synology-SA-24:20 (CVE-2024-10441 code execution, CVE-2024-50629 file read, CVE-2024-10445 file write) but does not say which flaw is used. Victims report a C3RB3R ransom note. Some third-party researchers instead link the campaign to two newer DSM flaws fixed Sept 18; Synology has not confirmed that."
status: "official (Synology press release Oct 29; HKCERT alert Nov 2); the exploited CVE is not named by Synology"
published: 2026-11-02
---

> Synology said on Oct 29 that attackers are exploiting a vulnerability patched in December 2024 to encrypt data on NAS devices running outdated DSM, and urged everyone to update and turn on automatic updates. It points to advisory Synology-SA-24:20 (CVE-2024-10441 code execution, CVE-2024-50629 file read, CVE-2024-10445 file write) but does not say which flaw is used. Victims report a C3RB3R ransom note. Some third-party researchers instead link the campaign to two newer DSM flaws fixed Sept 18; Synology has not confirmed that.

[← Cybersecurity News](/news) · [markdown](/items/synology-c3rb3r-ransomware-outdated-dsm-oct-29.md)

official (Synology press release Oct 29; HKCERT alert Nov 2); the exploited CVE is not named by Synology

2026-11-02

### Synology: ransomware gangs are exploiting an old, patched DSM flaw to encrypt NAS boxes running outdated DiskStation Manager; victims see .L0CK3D files and a read-me3.txt 'C3rb3r Decryptor' note

In a press release dated **Oct 29**, Synology said it "has identified threat actors exploiting a vulnerability patched in December 2024 to target devices running outdated versions of DSM" to encrypt data and extort a ransom. It told users to update DSM immediately and enable automatic updates, and linked **Synology-SA-24:20**, which covers **CVE-2024-10441** (code execution), **CVE-2024-50629** (file read) and **CVE-2024-10445** (file write). Synology does not say which of them, if any, is the one being used. HKCERT issued a ransomware alert on **Nov 2** repeating the guidance.

- **What victims see:** files renamed with a `.L0CK3D` extension and a `read-me3.txt` note telling them to buy the "C3rb3r Decryptor" (BleepingComputer, from victim reports going back more than two weeks).
- **Competing root-cause claims:** some third-party write-ups (citing 360's anti-ransomware team) link the campaign to **CVE-2026-13639** and **CVE-2026-13684**, fixed in **Synology-SA-26:13** on Sept 18. Synology's own statement points to the 2024 advisory instead, so treat the exact entry point as unconfirmed and patch both.

**What to do:** update every DSM box to the newest build its model supports (at least the SA-26:13 fixed releases: 7.4-90075, 7.3.2-86009-4, 7.2.2-72806-9 or 7.2.1-69057-12), turn on automatic updates, remove router port forwards to DSM's management ports and use a VPN instead, disable the default admin account, enable two-step sign-in, and keep immutable snapshots plus one offline backup. Devices stuck on end-of-life DSM should be replaced. If you find `.L0CK3D` files, disconnect the NAS, keep the logs and note, and restore only from a clean backup after rebuilding.

Sources: [Synology: urges users to update DSM following ransomware attacks on outdated DSM versions (Oct 29)](https://www.synology.com/en-global/company/news/article/C3RB3R/Synology) · [Synology-SA-24:20](https://www.synology.com/en-global/security/advisory/Synology_SA_24_20) · [Synology-SA-26:13](https://www.synology.com/en-global/security/advisory/Synology_SA_26_13) · [HKCERT: Ransomware attacks targeting Synology NAS devices (Nov 2)](https://www.hkcert.org/security-bulletin/security-alert-ransomware-attacks-targeting-synology-nas-devices_20261102) · [BleepingComputer: Synology warns of C3RB3R ransomware attacks (Nov 2)](https://www.bleepingcomputer.com/news/security/synology-warns-customers-of-ongoing-c3rb3r-ransomware-attacks/)