Cybersecurity
Synology urges updates after ransomware attacks
Synology said it had seen threat actors abusing a flaw patched in December 2024 against outdated DiskStation Manager versions, after customers reported C3RB3R ransomware on Synology devices.
- Synology said it had observed attackers exploiting a flaw patched in December 2024 against devices running older DSM versions.
- The company linked the activity to a November 2024 advisory listing three DSM vulnerabilities and the releases that fixed them.
- Customers reported C3RB3R ransomware on Synology devices, with encrypted files marked by a .L0CK3D extension.
- Qihoo 360 Internet Security Center said C3RB3R had a long record against NAS devices and had used two DSM flaws fixed by Synology in September 2026.
Synology said it had seen attackers using a flaw fixed in December 2024 to hit devices that were still running older DSM releases. The company said the purpose was to lock data and demand payment.
Synology did not name the weakness, but it pointed to a November 2024 security advisory that listed three DSM vulnerabilities and the versions that corrected them. The fixes covered DSM 7.2.2, 7.2.1, 7.2, 7.1 and 6.2.
The report also said customers had seen C3RB3R ransomware on Synology devices. Qihoo 360 Internet Security Center said in an analysis last week that the family had a long record against NAS devices, including use of two Synology flaws fixed in September 2026.
Qihoo 360 said the malware scanned files on an infected device, avoided 27 directories and some file types, and renamed encrypted files with the .L0CK3D suffix while leaving a note called read-me3.txt. The article also cited earlier ransomware cases involving QNAP Systems, Synology and Palo Alto Networks Unit 42, and quoted Synology urging users to patch and turn on automatic updates.
Named in this story
Companies
- Synology
- urged customers to update DSM after seeing active attacks
- QNAP Systems
- its NAS devices were hit by ransomware in 2019
Organisations
- Qihoo 360 Internet Security Center
- published an analysis of C3RB3R last week
- Palo Alto Networks Unit 42
- disclosed an eCh0raix variant targeting NAS devices
Products and systems
- DiskStation Manager (DSM)
- the NAS software that was targeted and patched
- C3RB3R ransomware
- the malware reported to lock files and add a .L0CK3D suffix
- QNAPCrypt
- the ransomware that compromised QNAP NAS devices in 2019
- StealthWorker
- a malware family linked to brute-force attacks on Synology devices in 2021
- eCh0raix
- a ransomware variant that targeted QNAP and Synology devices
How the source tells it
The piece was a straightforward security report with a mildly urgent advisory tone.
- urgency repeated calls to update immediately and to enable automatic updates