TechAtelier
CYBERSECURITY · NAS · RANSOMWARE

Synology NAS ransomware: how to protect against C3RB3R attacks

Synology has warned that ransomware attackers are exploiting a vulnerability fixed in December 2024 in outdated DSM installations. Here are practical steps for NAS owners.

What Synology has confirmed

On October 29, 2026, Synology reported threat actors exploiting a vulnerability patched in December 2024 on devices running outdated DiskStation Manager (DSM) versions. Their goal is to encrypt data and demand a ransom. Synology refers users to Synology-SA-24:20. The vendor has not publicly established which specific CVE is being exploited in this campaign. Do not confuse this incident with other DSM vulnerabilities or PHP2Shell.

Warning signs

Reports from affected users describe files renamed with the .L0CK3D extension (the character after L is a zero) and a ransom note named read-me3.txt. These are useful investigation indicators, but their absence does not rule out compromise. Unexpected logins, widespread file changes or unusual resource use also warrant investigation.

Five checks for NAS owners

  1. Verify your DSM build in Control Panel → Update & Restore. Install the newest compatible update for your model and review Synology security advisories.
  2. Update installed packages through Package Center. DSM updates do not necessarily cover every application package.
  3. Reduce Internet exposure: avoid directly exposing the DSM management interface, audit router port forwarding, disable unused services and use secure remote access.
  4. Secure identities: use multifactor authentication, unique passwords, least privilege and disable unused accounts.
  5. Test backups using an offline, immutable or isolated copy. Local snapshots are useful but do not replace separate backups.

If you suspect encryption or compromise

Isolate the NAS from the network to limit further activity. Preserve ransom notes, logs and other potential evidence instead of deleting everything immediately. Seek qualified incident response support to determine the scope. Rotate affected credentials from a trusted device. Remediate the intrusion path before restoring data, and verify backups are clean. Paying a ransom does not guarantee recovery.

Why this matters for TechAtelier

NAS devices may hold business files, family photos and important backups. Availability monitoring is not enough: software versions, network exposure and recovery readiness also need attention. Practical DSM monitoring combines device inventory, security advisories, service checks and alerts; no single check can guarantee that a system is uncompromised.

Sources

Published November 3, 2026.