Synology has issued its first ransomware warning in seven years. The door it names was patched in 2024

Synology does not do alarm. The last time it published a warning about an attack on its customers was August 2019. So the notice it posted on 29 October, titled "Synology urges users to update DSM following ransomware attacks on outdated DSM versions," is worth taking at face value. A strain called C3RB3R, a descendant of the old Cerber family, has been encrypting Synology NAS boxes since early October. Victims find their files renamed with a .L0CK3D ending and a note called read-me3.txt in every folder. According to Techaeris, the note asks for 0.03696 bitcoin, about $2,950, and the price doubles after five days. No free decryptor exists.

Synology's explanation is blunt: the attackers are using a flaw it fixed in December 2024, covered by advisory SA-24:20, against devices that never installed the update. The Chinese security firm 360 points instead at two critical bugs Synology patched on 18 September this year, and one response team says it saw a victim on a fairly recent DSM 7.4.1 build. Nobody disputes the core of it, though. These are machines sitting on the internet with an outdated operating system and the management page reachable from anywhere. Shadowserver counts more than 380,000 Synology NAS devices exposed online.

If you own one, open DSM, go to Control Panel, Update & Restore, and install whatever is waiting. BleepingComputer lists the minimum safe builds as 7.4-90075, 7.3.2-86009-4, 7.2.2-72806-9 and 7.2.1-69057-12, depending on which branch you're on. Turn on automatic updates while you're there, which Synology now explicitly recommends. Then make sure the admin interface isn't reachable from outside your home: no port forwarding to it, no QuickConnect you don't use. One detail from the analysis deserves repeating. The ransomware also encrypts any backups stored on the same NAS. A snapshot on the box that got hit is not a backup.

Tendvane's one-click backup copies Documents, Pictures and Desktop to a drive you choose, and a copy on a drive you can unplug is exactly the kind this ransomware can't reach.