Skip to content
NewA calmer, faster ZeroHour
StoryRansomwarehighExploited in the wild

Synology Warns of Ransomware Attacks on Outdated NAS Devices

2 sources · 2 articlesFirst reported Updated ()
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Synology warns of ransomware attacks on outdated NAS devices exploiting a patched DSM flaw linked to C3RB3R.

Synology reported ransomware attacks on NAS devices exploiting a vulnerability patched in December 2024 in the system plugin daemon. The issue could lead to remote code execution on outdated DSM versions. Customers using C3RB3R ransomware saw files locked with .L0CK3D extensions. The vendor urges immediate upgrades and automatic updates. Synology-SA-24:20 covers three CVEs but does not specify which is in use.

Key facts
  • Exploits system plugin daemon flaw for RCE (CVE-2024-10441, CVSS 9.8)
  • Linked to C3RB3R ransomware encrypting files with .L0CK3D extensions
  • Patched in DSM 7.2.2-72806-1 and earlier versions
  • Synology-SA-24:20 advisory covers CVE-2024-10441, CVE-2024-50629, CVE-2024-10445
  • Fixes issued for DSM 7.2.2, 7.2.1, 7.2, 7.1 and 6.2
  • Notice issued October 29, 2026
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 29, 2026Synology issues notice on ransomware attacks exploiting patched DSM flaw · Security Affairs
  2. Nov 3, 2026The Hacker News reports Synology NAS targeted in ransomware attacks · The Hacker News
  3. Nov 3, 2026Security Affairs reports Synology warns of ransomware attacks · Security Affairs

What each outlet adds

beyond the shared facts
  • The Hacker NewsDetails on C3RB3R ransomware and .L0CK3D encrypted files
  • Security AffairsThree CVEs with ratings, Synology-SA-24:20 advisory and October 29 notice date
CVEs
CVE-2024-10441CVE-2024-50629CVE-2024-10445
Vendors
Synology
Products
DSMDiskStation Manager
Malware
C3RB3R

Coverage

oldest first · one row per article · UTC
  1. · 6d ago The Hacker NewsFirst report

    Synology NAS devices targeted in ransomware attacks

    Threat actors exploit a patched DSM flaw to encrypt data on unupdated Synology NAS devices using C3RB3R ransomware.

  2. · 6d ago Security Affairs

    Synology warns ransomware hits NAS devices on outdated DSM

    Attackers exploit a flaw patched in December 2024; Synology has not said which of three CVEs is used.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2024-10441
+2 related CVEs
CVE-2024-50629CVE-2024-10445
Improper encoding or escaping of output vulnerability in the system plugin daemon in Synology BeeStation OS (BSM) before 1.1-65374 and Synology DiskStation…
9.8
group max
1%