Ransomware Is Going After Synology NAS Boxes — Patch Yours Now
That little Synology box humming away in the comms cupboard is exactly what the latest ransomware campaign is hunting. If it's running an old version of DSM, now's the time to check it.
On 29 October, Synology warned that attackers are encrypting files on NAS devices running outdated DiskStation Manager (DSM) and demanding a ransom. Security firm Qihoo 360 is tracking the same activity as a strain called C3RB3R, which renames scrambled files with a .L0CK3D extension and drops a ransom note. There's some disagreement on exactly how the attackers get in. Synology points to a flaw it patched back in December 2024, while 360 links the incidents to two critical DSM vulnerabilities fixed in September 2026. Either way, the fix is the same: get onto a current version of DSM.
Why this one matters for Australian businesses
Loads of small and mid-sized Aussie firms run a Synology NAS. It's cheap, reliable, and it quietly stores the shared drive, the accounts files, and often the backups too. That last part is the problem. In plenty of the environments we see across Sydney and the Central West, the same NAS is doing double duty as the live file server and the backup target, and it's been port-forwarded or left on QuickConnect so someone can get to files from home. That's a device sitting on the open internet, holding your only copy of everything, running firmware nobody's looked at since it was installed.
"If your only backup lives on the same NAS that just got encrypted, you don't have a backup. You have a second copy of the ransom note."
Dan Briggs, All IT ServicesPatching matters, but it's worth being clear about what it does and doesn't fix. Updating DSM closes the entry point so you don't get hit again. It does not decrypt files that are already locked. A NAS that still boots and responds isn't proof your data is safe, so don't assume you've dodged it just because the login screen still loads.
What to do this week
- Update DSM now. Check Control Panel > Update & Restore and get onto the latest release for your model. The September fixes land at DSM 7.4-90075, 7.3.2-86009-4, 7.2.2-72806-9 or 7.2.1-69057-12 and later.
- Turn on automatic updates. A NAS that patches itself is one less thing to forget. This is the single easiest win here.
- Get it off the public internet. Drop any port-forwarding and QuickConnect exposure. If staff need remote access, put it behind a VPN instead.
- Check your backups are actually separate. Make sure a copy lives somewhere the NAS can't reach, whether that's immutable cloud storage or an offline drive, and that it predates any compromise.
- If you see a ransom note or .L0CK3D files, isolate the device from the network, don't wipe it, and call for help. Preserve the note and logs for whoever investigates.
Synology-SA-26:13 DSM security advisory, Synology (18 Sep 2026)
Frequently Asked Questions
Which Synology devices are affected by the C3RB3R ransomware?
Synology NAS devices running outdated versions of DiskStation Manager (DSM). Synology is urging anyone on a vulnerable version to update DSM straight away. If you have automatic updates turned off and haven't patched in months, assume you're in scope until you've checked.
I've just updated DSM. Does that remove the ransomware?
No. Updating closes the door attackers used to get in, but it does not unlock files that are already encrypted. If your NAS is already showing a ransom note or .L0CK3D files, patching won't bring the data back. Isolate the device and restore from a clean backup that predates the attack.
Should my NAS be reachable from the internet?
Almost never directly. If staff need remote access to files, put the NAS behind a VPN rather than port-forwarding it or exposing QuickConnect to the open internet. A NAS that can be reached by anyone online is a NAS that can be attacked by anyone online.
Is a single NAS enough for backups on its own?
No. If your only backup lives on the same NAS that gets encrypted, you don't have a backup. Follow the 3-2-1 rule: three copies, on two types of media, with one kept offline or immutable so ransomware can't reach it. Test that you can actually restore from it.
Not sure if your NAS is exposed?
We'll check your Synology firmware, lock down remote access and make sure your backups can survive a ransomware hit. One quick review beats finding out the hard way.