> ## Content Index
> Fetch the complete content index at: https://www.skimwire.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Synology NAS owners: update DSM now as C3RB3R ransomware hits old versions
- URL: https://www.skimwire.com/synology-nas-c3rb3r-ransomware-update-dsm/
- Published: 2026-11-03T13:47:17.000Z
- Updated: 2026-11-03T13:47:17.000Z
- Description: Synology says attackers are using a flaw patched in December 2024 to encrypt outdated NAS devices. Update DSM and lock down remote access.
- Author: Skimwire Staff
- Tags: Security

## The skim

- Synology says attackers are exploiting a flaw it patched in December 2024 to hit Synology NAS devices running outdated versions of DSM with C3RB3R ransomware.
- Synology points to a 2024 advisory whose most serious bug, CVE-2024-10441, can let a remote attacker run code on the device. It hasn't said exactly which flaw is being used.
- If you own a Synology NAS, update DSM now, turn on automatic updates and make sure its admin page isn't reachable from the internet.

## What happened

In a [notice published Oct. 29](https://www.synology.com/en-global/company/news/article/C3RB3R/Synology%20urges%20users%20to%20update%20DSM%20following%20ransomware%20attacks?ref=skimwire.com), Synology warned that "Synology has identified threat actors exploiting a vulnerability patched in December 2024 to target devices running outdated versions of DSM." DSM is the operating system that runs Synology's network-attached storage boxes, which many homes and small offices use for file storage and backups.

Synology's notice refers users to advisory [Synology-SA-24:20](https://www.synology.com/en-global/security/advisory/Synology%5FSA%5F24%5F20?ref=skimwire.com), which covers three flaws: CVE-2024-10441, which lets remote attackers execute arbitrary code and is rated 9.8 out of 10, plus CVE-2024-50629 and CVE-2024-10445, which let attackers read and write files. Synology hasn't said which one is being exploited, and when BleepingComputer asked, a spokesperson pointed to the same advisory.

According to [BleepingComputer](https://www.bleepingcomputer.com/news/security/synology-warns-customers-of-ongoing-c3rb3r-ransomware-attacks/?ref=skimwire.com), victims started reporting infections more than two weeks ago. Infected devices get a ransom note named **read-me3.txt**, encrypted files get a **.L0CK3D** extension, and victims are told to buy a "C3rb3r Decryptor" from a dark web site for thousands of dollars. The same ransomware strain has previously hit Atlassian Confluence and GitLab servers. Hong Kong's [HKCERT](https://www.hkcert.org/security-bulletin/security-alert-ransomware-attacks-targeting-synology-nas-devices%5F20261102?ref=skimwire.com) issued its own alert on Nov. 2.

## Why it matters

This is the first time Synology has warned of an active ransomware campaign against its devices since the eCh0raix attacks in 2019, BleepingComputer notes. The Shadowserver Foundation tracks more than 380,000 Synology NAS devices exposed online, though it doesn't say how many are already patched.

A NAS is often where people keep the backups that are supposed to save them from ransomware. If the NAS itself gets encrypted, you can lose the originals and the safety net at the same time.

## What to do now

1. **Check your DSM version.** Sign in to DSM and open **Control Panel > Update & Restore**. The fixed versions are DSM 7.2.2-72806-1, 7.2.1-69057-6, 7.2-64570-4, 7.1.1-42962-7 and 6.2.4-25556-8 or later. Whatever you're on, install the latest update offered for your model.
2. **Turn on automatic updates** in the same Update & Restore section, as Synology recommends.
3. **Close the front door.** Block internet access to the DSM management web interface, as BleepingComputer advises. If you need remote access, use a VPN instead of forwarding the admin port on your router.
4. **Keep an offline or cloud copy** of anything irreplaceable, so the NAS isn't your only backup.

If you find a read-me3.txt note or .L0CK3D files, disconnect the NAS from the network and contact [Synology support](https://www.synology.com/en-global/company/contact%5Fus?ref=skimwire.com) before trying to restore anything.

*Sources:* [*Synology*](https://www.synology.com/en-global/company/news/article/C3RB3R/Synology%20urges%20users%20to%20update%20DSM%20following%20ransomware%20attacks?ref=skimwire.com)*,* [*Synology security advisory*](https://www.synology.com/en-global/security/advisory/Synology%5FSA%5F24%5F20?ref=skimwire.com)*,* [*BleepingComputer*](https://www.bleepingcomputer.com/news/security/synology-warns-customers-of-ongoing-c3rb3r-ransomware-attacks/?ref=skimwire.com) *and* [*HKCERT*](https://www.hkcert.org/security-bulletin/security-alert-ransomware-attacks-targeting-synology-nas-devices%5F20261102?ref=skimwire.com)*.*