Nice2GeekYou

Synology NAS Owners: Update DSM Now, C3RB3R Ransomware Is Encrypting Unpatched Drives

Synology warned customers last week that attackers are exploiting a flaw patched in December 2024 to encrypt data on Synology NAS devices running outdated DiskStation Manager (DSM) software and demand a ransom. Here's how a small business can check its NAS and lock it down today.

  • synology
  • nas
  • ransomware
  • c3rb3r
  • backup
  • patching
  • cybersecurity
  • smb
  • managed-it

If your office keeps files on a Synology NAS, update its DSM software today and take its admin page off the internet. Synology said in an advisory last Thursday that attackers are exploiting a vulnerability it patched in December 2024 to break into devices running outdated versions of DiskStation Manager (DSM), encrypt the data and demand a ransom. BleepingComputer reported on November 2, 2026 that the attacks are part of a wave of C3RB3R ransomware infections that started more than two weeks ago.

Why it matters

A NAS is often where a small business keeps its shared drive, its scanned paperwork and its backups, all in one box. When ransomware encrypts it, victims find their files renamed with a .L0CK3D extension and a ransom note called read-me3.txt pointing them to a dark web page selling a "C3rb3r Decryptor" for thousands of dollars.

Synology rarely puts out warnings like this. The last one, according to BleepingComputer, was in August 2019. The internet monitoring group Shadowserver tracks more than 380,000 Synology NAS devices that can be reached from the internet, and every one still on old software is a target. The fix has been available for almost two years, so these break-ins hit devices that simply never got updated.

What to do this week

  1. Check your DSM version. In DSM, open Control Panel and then Update & Restore. Synology's fixed releases are 7.2.2-72806-1, 7.2.1-69057-6, 7.2-64570-4, 7.1.1-42962-7 and 6.2.4-25556-8, or anything newer on your branch.
  2. Turn on automatic updates. Synology recommends this so DSM stays current without anyone having to remember.
  3. Block the admin page from the internet. Close any router port forwards to the NAS's management page (commonly ports 5000 and 5001). If you need remote access, use a VPN instead.
  4. Keep a backup the NAS can't touch. If the NAS is your backup, keep at least one more copy offline or in the cloud, with versioning or immutable snapshots, so ransomware on the NAS can't wipe out your only copy.
  5. Retire what can't be updated. If your model no longer gets DSM updates, plan to replace it rather than leave it exposed.

Nice2GeekYou is based in San Antonio and serves all of Texas on site, and our managed IT plans cover remote clients across the U.S. We patch and monitor NAS devices, close risky router ports, and set up backups that ransomware can't reach. Request a quote, see our monthly plans, or text us at (210) 504-8969.

Sources: BleepingComputer — Synology warns of C3RB3R ransomware attacks targeting NAS devices (Nov 2, 2026).