Synology NAS Ransomware 2026: C3RB3R Locks Files on Unpatched DSM
Synology NAS ransomware is back, and the way in is old software. Attackers are hitting network attached storage units stuck on outdated firmware, scrambling files with a .L0CK3D tag and demanding payment to hand them back.
Anyone who kept updating was never in the blast radius.
What Happened?
Synology told customers that attackers are exploiting a flaw it fixed back in December 2024. Devices still running old DiskStation Manager (DSM) builds are the ones getting hit.
Two Clues Left on Every Locked Box
Security teams tracking the campaign call the strain C3RB3R. Victims report files renamed with a .L0CK3D extension and a ransom note, read-me3.txt, dropped into every folder. Synology has not named the exact bug, confirmed how many boxes are hit, or stated a ransom figure.
A Patch That Is Almost Two Years Old
One detail stands out. The patch is almost two years old. The people at risk are the ones who set up a box, loaded their files, and then stopped looking at it.
The gap attackers waited out
No clever zero day here. Just the oldest pattern in security: a fix ships, a chunk of the install base never applies it, and attackers wait for the window to widen.
A NAS behaves like an appliance. You buy it, tuck it in a closet, and treat it like a drive with a network cable. The firmware underneath freezes on setup day, and that is the gap attackers count on.
What’s the Impact?
Why Synology NAS Ransomware Takes Your Backups Too
A NAS is often the one box holding everything, backups included. When C3RB3R locks it, the primary data and the safety net go down together. Small shops feel this worst. Few run detection tools on a storage appliance, so an attacker can work quietly for days before anyone notices.
The backup trap
A NAS concentrates value in one place, behind one login. When it is also the backup target, the primary data and the safety net get encrypted in the same move.
The fix is an old rule that still holds: keep one backup copy offline, on separate media, where ransomware on the NAS cannot reach it.
An Old Story With a New Name
A vendor ships a fix, a slice of the install base never applies it, and attackers wait for the gap to widen. Regulators have started treating aging edge devices as a risk of their own, and the habits that close the gap, a patch cadence you can prove and a clear view of every device you own, are the same ones that would have stopped this cold.
The fix here is boring, and it works. Patch first, then shrink the attack surface around the box.
How to Avoid This
- Check your DSM version in Control Panel, then Info Center
- Update to the latest build your model supports, today, not this weekend
- Turn on automatic updates so the next patch never sits waiting for a click
- Pull the NAS off the open internet and put it behind a VPN
- Keep one backup copy offline, where ransomware cannot reach it
The minimum safe DSM build for every branch
Open Control Panel, then Info Center, and read your DSM version. If your number is at or above the one here, you already carry the December 2024 fix. If it is lower, update now. These are the floors, not the finish line, so move to the newest build your model supports.
Prefer the command line? With SSH on, run cat /etc.defaults/VERSION and match the build to your branch. Then turn on automatic updates so the next patch never waits for a click.
Source: Synology advisory Synology-SA-24:20. Figures are minimum fixed releases per branch.
Signs of Synology NAS Ransomware on Your Box
If you think a device is already compromised, scan for the two file clues first. The other indicators below come from single research labs, so verify them before you block anything.
What to hunt for on a Synology box you think might be hit
Two indicators are reported consistently by multiple named research teams. The rest come from individual labs and have not been confirmed by Synology or a major incident response vendor. Check the high confidence set first, and validate the provisional set in your own environment before you block or alert on it.
File artifacts left on the device
.L0CK3D appended to locked files (zero in place of the O). A .LOCK3D spelling also appears in forum reports.read-me3.txt written into every folder and the root directory. Note text includes the string C3RB3R INSTRUCTIONS.Host and network artifacts
http://46.8.78.122/xdy5.sh, with a failed sign in from the same address seen shortly before encryption in one case.a1375e0f82ae86df528876c049b5a23c (one reported sample).libgld and qnetd reported as encryptor payloads under /bin/; a marker file l0ck.enc and xdy5* files also noted./etc/cron.d/synot* running every minute, and lines containing base64 -d, | sh, curl/wget, or xdy5.LD_PRELOAD=, PLUGIN_VALUE_START, and SYNO.API.Auth login payloads in /var/log/synoscgi.log and synoplugin.log.Sourcing: 360 Security Team, Solar / Dongyun Lab, community incident trackers (Oct 28 to Oct 30, 2026), The Hacker News, BleepingComputer. Synology has not published an official IOC set. Verify before acting.
Old Boxes Are Easy Prey. A Governed Teammate Watches the Ones You Forgot.
The gap here was not a clever exploit. It was a box nobody was watching and a patch nobody applied. Secure.com puts a governed AI teammate on that blind spot, so forgotten gear gets found before an attacker finds it first.
- Finds internet facing devices and aging firmware before attackers scan for them
- Surfaces the unpatched boxes that never made it onto your asset list
- Confirms what is actually exploitable, so you fix the gap that matters first
- Watches storage and edge gear for the odd file activity that signals encryption
- Every action waits for your approval, with a full record of what changed