【Vulnerability Alert】Synology NAS Devices Targeted by Large-Scale Ransomware Attacks, Files Encrypted with the .L0CK3D Extension. Please Update DSM Immediately
Source: Ministry of education information & communication security contingency platform
| Publication Number | / | Publication Time | 2026-10-29 00:00:00 |
| Incident Type | ANA-Vulnerability Alert | Discovery Time | 2026-10-29 00:00:00 |
| Impact Level | High | ||
| [Subject] 【Vulnerability Alert】Synology NAS Devices Targeted by Large-Scale Ransomware Attacks, Files Encrypted with the .L0CK3D Extension. Please Update DSM Immediately |
|||
| [Content]
Synology issued a cybersecurity alert on October 29, 2026, confirming that attackers are exploiting security vulnerabilities that were patched in December 2024 to launch attacks against NAS devices still running outdated versions of DiskStation Manager (DSM), encrypting stored data and demanding ransom payments. The vendor urges affected users to update DSM immediately and enable automatic updates. For information on the relevant vulnerabilities, please refer to the Synology-SA-24:20 security advisory. In addition, according to an analysis of affected cases released by a cybersecurity team, this wave of attacks involves C3RB3R, a variant of the Cerber ransomware. The file extensions of affected files are changed to ".L0CK3D", and a ransom note named "read-me3.txt" is left in the directories. This may result in inaccessible files, service interruptions, and data loss. Users are advised to check the DSM and package versions of their NAS devices as soon as possible, complete the necessary security updates, restrict unnecessary external access, and ensure that backup data is protected through offline storage or isolation. If encrypted files or ransom notes are detected, affected devices should be isolated immediately, relevant logs and files should be preserved, and the vendor should be contacted for assistance. Information Sharing Level: WHITE (Information content can be publicly disclosed) |
|||
|
[Affected Platform] Synology DiskStation Manager (DSM) 7.1 Synology DiskStation Manager (DSM) 7.2 / 7.2.1 / 7.2.2 Synology BeeStation Manager (BSM) Synology Unified Controller (DSMUC) |
|||
|
[Recommended Actions] Synology DiskStation Manager (DSM) 6.2: Upgrade to version 6.2.4-25556-8 or later Synology DiskStation Manager (DSM) 7.1: Upgrade to version 7.1.1-42962-7 or later Synology DiskStation Manager (DSM) 7.2 / 7.2.1 / 7.2.2: Please upgrade to versions 7.2-64570-4, 7.2.1-69057-6, or 7.2.2-72806-1, respectively (or later versions) Synology BeeStation Manager (BSM): Please upgrade to version 1.1-65374 or later Synology Unified Controller (DSMUC): Upgrade to version 3.1.4-23079 or later |
|||
|
[Reference] |
|||
If you have questions or suggestions regarding this notification, please feel free to contact us.
Ministry of education information & communication security contingency platform
Website: https://info.cert.tanet.edu.tw/
Phone: +886-7-5250211
Internet Phone: 98400000
E-Mail: service@cert.tanet.edu.tw