Criminals are locking files on Synology storage boxes that run old software. Here is how the attack works and how to protect your files.
Criminals are locking files on Synology storage boxes that run old software. Then they ask for money to give the files back. If you own a Synology device, update its software today and turn on automatic updates.
What is happening
Synology makes NAS devices. NAS stands for Network Attached Storage. It is a small box that holds files, photos and backups on your home or office network. Many families and small businesses use one.
The box runs software called DiskStation Manager, or DSM for short. According to The Hacker News, Synology is urging customers to update DSM after ransomware attacks. Ransomware is harmful software that scrambles your files so you cannot open them. Then the attacker asks for payment.
Synology said the attackers are going after devices with older versions of DSM. In its own words, "These attacks aim to encrypt data and extort ransom." To encrypt means to scramble data so only someone with a secret key can read it.
How the attack works
The attackers use a known weakness in older DSM software. Synology fixed it in December 2024. That means the fix has been available for a long time. Synology did not say exactly which flaw is being used. It pointed to a security notice from November 2024 that listed three flaws.
Some customers say their devices were hit by ransomware called C3RB3R. Here is what it does, based on the report:
- It searches the files on the box.
- It skips 27 folders and some system file types, so the box keeps running while it works.
- It locks your files and adds ".L0CK3D" to the end of each file name.
- It leaves a ransom note named "read-me3.txt" in each folder it locked.
A security company called Qihoo 360 says C3RB3R has a "long history" of attacking NAS devices. The report says it has also used two other DSM flaws that Synology fixed in September 2026.
Who is at risk
The main risk is for anyone with a Synology box that has not been updated. This could be a family photo server or the file server in a small office. Many people set up a NAS once and then forget about it. That is how old software can stay in place for years.
This kind of attack is not new. The report notes earlier cases:
- In 2019, NAS devices made by QNAP were hit by ransomware called QNAPCrypt, also known as eCh0raix.
- In August 2021, Synology warned of attacks by malware called StealthWorker. Those attacks tried to guess common admin passwords. If a guess worked, the attackers could install ransomware.
- That same month, Palo Alto Networks Unit 42 described a version of eCh0raix that went after both QNAP and Synology boxes. It used known flaws or guessed common admin passwords.
Other news this week shows the same pattern. Help Net Security reports that attackers are using a flaw in a tool called Node-RED. Attacks were seen more than two months after Siemens disclosed the flaw. A researcher advised people to apply updates where they are available. Also, a payment software maker called BTCPay Server urged users to install its latest version, says The Hacker News. Thefts there hit servers running older versions.
The lesson is simple. Old software and weak passwords are the two doors attackers try first.
What to do now
Synology "strongly urges all users running vulnerable versions to update DSM immediately." Here are steps to take today:
- Update DSM. Sign in to your Synology box and install the latest DSM update.
- Turn on automatic updates. Synology recommends this so DSM stays up to date at all times.
- Use a strong, unique admin password. Past attacks worked by guessing common passwords. Pick a long password you do not use anywhere else.
- Keep a second copy of important files. Store it somewhere that is not always connected to the NAS. An external drive you unplug after use is one choice.
- Check who manages the box. If an IT helper set it up, ask them to confirm it is updated.
If you were hit
Look for two signs. Your files may end in ".L0CK3D". You may also see a file called "read-me3.txt" in your folders.
- Disconnect the box from your network and the internet. This can help stop more harm.
- Do not delete the ransom note or locked files yet. They may help an expert see what happened.
- Contact a trusted IT professional or Synology support before you do anything else.
- Once the box is clean, update DSM and change every password used on it.
The first step for everyone, hit or not, is the same. Get DSM up to date.
Have a question about anything here? Email me at sales@appwt.com or call (888) 565-0171, and I will answer it.
Sources
- Synology NAS Devices Targeted in Ransomware Attacks Exploiting Patched DSM Flaw, The Hacker News, 2026-11-03
- Attackers exploit critical Node-RED flaw to deploy Linux bot and backdoors (CVE-2026-58115), Help Net Security, 2026-11-03
- Hackers Exploit BTCPay Server Flaw to Steal Bitcoin and Litecoin From Hot Wallets, The Hacker News, 2026-11-03
Tags
Frequently Asked Questions
What is a Synology NAS?
It is a small storage box made by Synology that holds files on your home or office network. It runs software called DiskStation Manager, or DSM.
Which Synology devices are at risk?
Synology says attackers are targeting devices running older versions of DSM. The flaw being used was fixed in December 2024.
How do I know if my files were locked?
Locked files have ".L0CK3D" added to the end of their names. A ransom note named "read-me3.txt" is left in each locked folder.
What does Synology tell users to do?
Synology urges users on vulnerable versions to update DSM immediately. It also recommends turning on automatic updates.
Have NAS devices been attacked before?
Yes. QNAP devices were hit by ransomware in 2019. In 2021, Synology warned of attacks that guessed common admin passwords.
Enjoyed this article?
Share it with your network
