If you keep family photos, business files or backups on a Synology network storage box, now is the time to check for updates. Synology has urged users running outdated versions of its DSM operating system to update immediately, after reports of ransomware attacks that lock files and leave a ransom note behind.
Synology’s network-attached storage (NAS) devices are popular with small businesses, photographers and home users across Ireland. They are often left plugged in and forgotten for years, which is exactly what makes them attractive to attackers.
What is happening?
According to a detailed round-up published on Friday by the specialist site NAS Compares, the Chinese security company Qihoo 360 says its anti-ransomware service has been receiving requests for help from Synology owners since early October. Victims have been hit by a strain called C3RB3R, a variant of the long-running Cerber ransomware family.
Infected files are renamed with a .L0CK3D extension, and a ransom note titled read-me3.txt appears in affected folders. Qihoo 360 has advised victims not to pay.
On 29 October, Synology issued a notice urging anyone on a vulnerable DSM version to update straight away and recommending that automatic updates be switched on. Its public warning says attackers are targeting devices on outdated software. It does not name the ransomware family or say how many people have been affected.
How are the attackers getting in?
This is where the picture gets murky. Qihoo 360 says the samples it examined exploited two DSM flaws, CVE-2026-13639 and CVE-2026-13684, which Synology fixed in a security advisory on 18 September. Synology’s own warning points to a much older flaw, a critical remote code execution bug patched in December 2024.
NAS Compares notes that it is not clear whether these accounts describe different attacks, different ways in, or overlapping activity. What both accounts agree on is that the devices being hit are running software that has not been updated.
Separately, two critical vulnerabilities in the PHP programming language, nicknamed “PHP2Shell”, affect some Synology apps that serve web pages. These include Calendar, Mail Station and Web Station, and third-party packages such as WordPress, Joomla and phpMyAdmin. There is no evidence so far that PHP2Shell is behind the ransomware attacks. Synology has extended PHP fixes to older DSM versions back to 6.2. Synology Drive and Hyper Backup are listed as not affected.
What you should do now
If you own a Synology NAS, the steps recommended in the coverage are straightforward:
- Update DSM to the latest version for your model, and check Package Center for PHP and app updates. Mail Station needs a manual update.
- Turn on automatic updates, as Synology recommends.
- Stop exposing the box to the internet. Remove port forwarding to DSM on your router and use a VPN if you need remote access.
- Lock it down. Disable the default admin account, use a unique password, switch on two-step verification and turn off apps and SSH you do not use.
- Keep a real backup. Store an offline copy that ransomware cannot reach and test that you can restore it. Snapshots alone are not enough.
Anyone still running a version older than DSM 6.2 should temporarily disable affected web packages and move to a supported version.
If you find files ending in .L0CK3D, disconnect the NAS from your network immediately to limit the damage and keep it as it is for investigation. Businesses should also consider whether they need to report the incident to the Data Protection Commission if personal data is involved, and contact the Gardaí.
What happens next
Synology has not yet said how many devices have been hit, and the security community is still working out exactly which flaws are being exploited. Further advisories could follow as investigators compare samples. For owners, the message is the same whichever account turns out to be right: an up-to-date, offline-backed-up NAS that is not exposed to the open internet is a far harder target.
Sources
- NAS Compares: Synology LOCK3D / C3RB3R ransomware attack, everything you need to know (30 October 2026), summarising Synology’s 29 October notice, Synology security advisories SA-24:20 and SA-26:13, and Qihoo 360’s findings
Featured image: Synology ds213j by Fabian sigrist, CC BY-SA 4.0, via Wikimedia Commons.
Leave a Reply