Synology DSM Ransomware Wave (C3RB3R): Outdated NAS Under Attack, Update to Synology-SA-24:20 Fixed Builds Now

Status: Active ransomware campaign confirmed by Synology on 29 October 2026. Patches have been available since November–December 2024. Synology has not said which CVE in Synology-SA-24:20 is being exploited. As of our 3 November 2026 check, none of the advisory's three CVEs appears in CISA's Known Exploited Vulnerabilities (KEV) catalog.

Executive Summary

On 29 October 2026, Synology published a statement saying it "has identified threat actors exploiting a vulnerability patched in December 2024 to target devices running outdated versions of DSM. These attacks aim to encrypt data and extort ransom" (Synology). The company "strongly urges all users running vulnerable versions to update DSM immediately" and recommends turning on automatic updates. The statement points readers to Synology-SA-24:20, a Critical DSM advisory first published in November 2024 after Pwn2Own 2024.

That advisory covers three CVEs. The most serious is CVE-2024-10441, rated CVSS 3.1 9.8 (Critical): an unauthenticated remote code execution flaw in DSM's system plugin daemon. Synology has not publicly said which of the three CVEs the attackers use. When BleepingComputer asked, a Synology spokesperson pointed back to the same 2024 advisory (BleepingComputer). In this post, CVE-2024-10441 is the linked advisory's Critical RCE. It is the strongest candidate for unauthenticated remote exploitation, but it is not a confirmed exploited CVE.

BleepingComputer and victim reports name the ransomware C3RB3R. They say it drops a read-me3.txt ransom note and adds a .L0CK3D extension to encrypted files. Synology's own statement does not name the ransomware family.

This matters for third-party risk because Synology NAS boxes are common at small and mid-sized suppliers, MSPs and branch offices. They often hold file shares, backups and customer data. A supplier's NAS that has gone unpatched since 2024 is now a known ransomware target. If it is also the supplier's only backup, one intrusion can take out both production data and recovery.

What Happened

Vendor statement (confirmed). Synology's global newsroom post is dated 29 October 2026 and datelined Taipei. It says threat actors are exploiting a vulnerability patched in December 2024 against devices running outdated DSM, with the goal of encrypting data and demanding ransom. It urges an immediate DSM update and automatic updates, and it refers readers to Synology-SA-24:20 (Synology).

The US version of the release carries the same date but a Bellevue, WA dateline and a longer text. It says Synology found the activity "in conjunction with an impact investigation into the recently disclosed PHP2Shell vulnerabilities." It describes the targets as devices running end-of-life DSM versions, and it cites both Synology-SA-26:14 (PHP2Shell) and Synology-SA-24:20 (Synology US). The vulnerability being exploited is described as one "originally patched in December 2024". Synology does not say PHP2Shell is the ransomware entry point. We treat PHP2Shell as a separate issue that needs its own patching.

Press and CERT coverage (reported). BleepingComputer reported the warning on 2 November 2026. It describes a large wave of reports from Synology customers whose data was encrypted and who were told to buy a "C3rb3r Decryptor" from a dark-web portal. The first victim reports appeared more than two weeks before BleepingComputer's report (BleepingComputer). The Hacker News reported the same vendor statement and three-CVE advisory on 3 November, and said customers had reported C3RB3R using the .L0CK3D extension (The Hacker News). Hong Kong's HKCERT issued a ransomware alert on 2 November with update and incident-response guidance (HKCERT).

About the C3RB3R name (reported). According to BleepingComputer, the malware also goes by Cerber and CerberImposter. It borrowed its name from a notorious ransomware-as-a-service operation of the same name that emerged in 2016. Since December 2021 it has been used against Confluence and GitLab servers through publicly known RCE and authentication-bypass flaws. No group has publicly claimed this Synology campaign, and we make no attribution.

Precedent. Synology rarely warns customers about active attacks. BleepingComputer notes the last comparable alert came during the 2019 brute-force campaign that delivered eCh0raix ransomware. The Hacker News also recalls Synology's 2021 StealthWorker brute-force warning.

Technical Information

Synology-SA-24:20, "DSM (PWN2OWN 2024)", was published on 5 November 2024 and last updated on 28 March 2025. Its overall severity is Critical, its status is Resolved, and its Mitigation field reads "None" (Synology). It lists three CVEs:

CVE-2024-10441. Synology describes it as an "improper encoding or escaping of output vulnerability in the system plugin daemon in Synology BeeStation OS (BSM) before 1.1-65374 and Synology DiskStation Manager (DSM) before 7.2-64570-4, 7.2.1-69057-6 and 7.2.2-72806-1." It "allows remote attackers to execute arbitrary code via unspecified vectors." NVD records the Synology CNA score of 9.8 with weakness CWE-116 (NVD). The vector requires no authentication and no user interaction. That fits a campaign aimed at internet-reachable NAS boxes, but it does not prove this is the CVE being exploited.

What is not public. Synology has not released exploit details, the attack path, or which CVE or chain the C3RB3R operators use. We do not speculate about how exploitation works. Our assessment rests on what is public: Synology says a vulnerability patched in December 2024 is being exploited, and the advisory it links to has one unauthenticated network RCE.

Timing. Synology says the exploited vulnerability was "patched in December 2024." The advisory's revision history shows DSM 7.2.2 fixed on 5 November 2024, DSM 7.2.1 on 12 November, DSM 7.1 on 26 November, and DSM 6.2 on 5 December 2024. Any box still exposed today has missed patches that have been out for almost two years.

Affected Product Versions

Per Synology-SA-24:20 (Synology):

The CVE-2024-10441 description also names Synology BeeStation OS (BSM) before 1.1-65374.

Two cautions for inventory work:

• "Outdated" and "end-of-life." Synology's global statement says outdated DSM. The US release says end-of-life DSM. Any box below the fixed builds above is in scope. A box that cannot run a supported DSM release should be scheduled for replacement, not just patched.
• Build, not major version. "DSM 7.2" alone tells you nothing. Ask for the full build string, for example 7.2.1-69057-6.

Workaround and Mitigation

Synology lists no mitigation other than updating. The fix is to install the fixed DSM or BSM build.

1. Update now. Bring every DSM box to at least the fixed build for its branch, preferably the latest supported DSM release. Update BeeStation to BSM 1.1-65374 or later. Turn on automatic updates as Synology recommends.
2. Take DSM management off the internet. BleepingComputer advises NAS owners to "immediately block access to the management web interface from the Internet." Remove router port-forwards to DSM management, which uses ports 5000 (HTTP) and 5001 (HTTPS) by default unless changed (Synology). Put admin access behind a VPN or an allow-list.
3. Keep backups off the NAS. HKCERT recommends offline or immutable backups and regular restore tests. A backup stored on the same NAS, or on a share it can write to, is not a ransomware recovery plan.
4. Patch PHP2Shell separately. If PHP-dependent packages such as Web Station, WordPress, MailStation or Calendar are installed, apply the Synology-SA-26:14 package updates as well (Synology). Synology has not linked PHP2Shell to the ransomware, so treat it as parallel hygiene, not a substitute for the DSM update.
5. If files are already encrypted, follow HKCERT's sequence: isolate the NAS from the network, pause sync and backup jobs, preserve ransom notes and logs, bring in incident response, and restore only after the system is cleaned and patched. Installing updates does not decrypt files that are already encrypted (HKCERT).

Indicators of Compromise

Synology has published no IoCs (no hashes, IP addresses or domains) for this campaign. The only public markers come from BleepingComputer and victim reports, not from Synology:

• Ransom note file read-me3.txt (reported).
• Encrypted files renamed with the .L0CK3D extension (reported; also cited by The Hacker News).
• Note text directing victims to buy a "C3rb3r Decryptor" through a dark-web portal (reported).

We have not invented or derived any additional indicators. Treat a Synology box below the SA-24:20 fixed builds with DSM management reachable from the internet as an exposure finding. That is not proof of compromise.

What to Do With These Vendors Today (TPRM)

Many suppliers, including law firms, accountancies, design agencies, regional manufacturers and the MSPs behind them, keep file shares, project archives and backups on a Synology NAS. Synology confirms that attackers are actively encrypting outdated DSM boxes. That makes "we have a NAS in the office" a question worth asking today, especially for any supplier that holds your data or runs your backups.

Ask your critical vendors, and their IT providers, these questions:

1. Do you, or your IT provider, run Synology DSM or BeeStation anywhere that stores, syncs or backs up our data? Include branch-office and "shadow IT" boxes.
2. Is DSM management reachable from the internet? That includes port-forwarded 5000/5001 or custom ports and any direct web exposure. If so, when will it be closed or moved behind a VPN?
3. What DSM (or BSM) build does each box run, and on what date was it updated to at least the Synology-SA-24:20 fixed build (7.2.2-72806-1, 7.2.1-69057-6, 7.2-64570-4, 7.1.1-42962-7 or 6.2.4-25556-8)? Which boxes are on end-of-life DSM, and when will they be replaced?
4. Confirm that your backups of our data are not stored on the same NAS and that at least one copy is offline or immutable. Tell us when you last tested a restore.

Flag any vendor that cannot answer within days, or that reports a DSM build below the fixed releases with management exposed, for follow-up and escalation. Do not accept "auto-updates are on" as a substitute for a build number.

Our platform validates vendor claims against live attack-surface signal and chases findings to closure under your approval.

Need help working through Synology NAS / DSM suppliers still on outdated builds? Our team can help you prioritize them and track their answers. Talk to an expert

Sources

• Synology, "Synology urges users to update DSM following ransomware attacks on outdated DSM versions" (29 Oct 2026): https://www.synology.com/en-global/company/news/article/C3RB3R
• Synology US, "Synology urges users to apply security updates, extends PHP2Shell fixes to older DSM releases" (29 Oct 2026): https://www.synology.com/en-us/company/news/article/C3RB3R
• Synology-SA-24:20 DSM (PWN2OWN 2024): https://www.synology.com/en-global/security/advisory/Synology_SA_24_20
• Synology-SA-26:14 PHP2Shell: https://www.synology.com/en-global/security/advisory/Synology_SA_26_14
• NVD, CVE-2024-10441: https://nvd.nist.gov/vuln/detail/CVE-2024-10441
• Synology Knowledge Center, "What network ports are used by Synology services?": https://kb.synology.com/en-global/DSM/tutorial/What_network_ports_are_used_by_Synology_services
• BleepingComputer, "Synology warns of C3RB3R ransomware attacks targeting NAS devices" (2 Nov 2026, updated 3 Nov): https://www.bleepingcomputer.com/news/security/synology-warns-customers-of-ongoing-c3rb3r-ransomware-attacks/
• The Hacker News, "Synology NAS Devices Targeted in Ransomware Attacks Exploiting Patched DSM Flaw" (3 Nov 2026): https://thehackernews.com/2026/11/synology-nas-devices-targeted-in.html
• HKCERT, "Ransomware Alert – Ransomware Attacks Targeting Synology NAS Devices" (2 Nov 2026): https://www.hkcert.org/security-bulletin/security-alert-ransomware-attacks-targeting-synology-nas-devices_20261102
• KEV status, checked 3 Nov 2026: CVE-2024-10441, CVE-2024-50629 and CVE-2024-10445 are not in CISA's Known Exploited Vulnerabilities catalog (catalog version 2026.10.30): https://www.cisa.gov/known-exploited-vulnerabilities-catalog