> ## Content Index
> Fetch the complete content index at: https://blog.harshkohli.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Synology Warns of C3RB3R Ransomware: Update DSM Now
- URL: https://blog.harshkohli.com/synology-c3rb3r-ransomware-update-dsm/
- Published: 2026-11-02T15:08:18.000Z
- Updated: 2026-11-02T15:08:18.000Z
- Description: Synology says C3RB3R ransomware is hitting NAS boxes on outdated DSM. Here are the safe versions and the steps to lock your NAS down today.
- Author: Harsh Kohli
- Tags: Tech News, Software

If you own a Synology NAS and haven't touched its updates in a while, stop and check it today. Synology says ransomware gangs are breaking into boxes that run old versions of its DSM software and locking up everything stored on them.

## What happened

In a [notice dated October 29](https://www.synology.com/en-global/company/news/article/C3RB3R/Synology?ref=blog.harshkohli.com), Synology said attackers are exploiting a vulnerability it patched back in December 2024, going after devices still running outdated DSM releases. It didn't name the exact bug, but the notice points to its [SA-24:20 advisory](https://www.synology.com/en-global/security/advisory/Synology%5FSA%5F24%5F20?ref=blog.harshkohli.com), which covered flaws that let an attacker run code and read or write files on an unpatched NAS.

[BleepingComputer](https://www.bleepingcomputer.com/news/security/synology-warns-customers-of-ongoing-c3rb3r-ransomware-attacks/?ref=blog.harshkohli.com) (which [flagged it on X](https://x.com/BleepinComputer/status/2117217395697746101?ref=blog.harshkohli.com)) says owners started reporting infections more than two weeks ago. Victims find their files renamed with a .L0CK3D extension and a ransom note called read-me3.txt in their folders, pushing them to buy a "C3rb3r Decryptor" from a dark web site. Hong Kong's [HKCERT](https://www.hkcert.org/security-bulletin/security-alert-ransomware-attacks-targeting-synology-nas-devices%5F20261102?ref=blog.harshkohli.com) put out its own alert on November 2.

## Why it matters

Synology almost never publishes warnings like this. The last time was in 2019, during the eCh0raix brute-force wave. A NAS is often where the family photos, the work archive and the "backup of the backup" all live, so losing one hurts far more than losing a laptop. Shadowserver tracks more than 380,000 Synology boxes reachable from the internet, and plenty of them were set up years ago and then forgotten in a cupboard.

The annoying part is that the fix has been sitting there for almost two years. This is the kind of attack that only lands on devices nobody's been looking after.

## What to do

- Open DSM, go to Control Panel, then Update & Restore, and install the newest DSM your model supports. Turn on automatic updates while you're in there.
- Per SA-24:20, the minimum safe builds are DSM 7.2.2-72806-1, 7.2.1-69057-6, 7.2-64570-4, 7.1.1-42962-7 and 6.2.4-25556-8\. Newer is better.
- Don't leave the DSM login page open to the internet. Close port forwarding on your router and reach the NAS over a VPN instead. My [Tailscale vs WireGuard comparison](https://blog.harshkohli.com/tailscale-vs-wireguard/) covers the easy options.
- Keep at least one backup that's offline or can't be overwritten, like a USB drive you unplug afterwards.
- Already seeing .L0CK3D files? Pull the network cable, don't reset the box, and get help before you do anything else. Updating DSM won't decrypt files that are already locked.