A ransomware strain called C3RB3R is actively hitting Synology network-attached storage devices, locking files and demanding bitcoin payments from victims who, in many cases, were running software patched nearly two years ago.
Synology confirmed the attacks on October 29, pointing to CVE-2024-10441, a critical remote code execution flaw in its DiskStation Manager operating system rated 9.8 out of 10 on the CVSS scale. The vulnerability was found at Pwn2Own 2024 by DEVCORE researchers Pumpkin Chang and Orange Tsai, and Synology patched it by December 2024 under security advisory SA-24:20. The patch has been available ever since. The fact that attackers are still finding success with it tells you something about how many users never applied it.
Once attackers get into a device, C3RB3R goes to work quickly. The ransomware skips 27 system directories and a handful of file types, then recursively encrypts everything else. Each file receives its own 256-bit encryption key generated on the fly, locked with ChaCha8 and then wrapped with RSA-2048, which means there is no way to crack it without the attacker's private key. The malware drops a ransom note called read-me3.txt into every affected folder, containing a six-digit victim ID and a Tor address. Files come out the other side with a .L0CK3D extension. Backups stored on the same NAS are not spared.
The ransom demand starts at 0.036960 bitcoin, which works out to roughly $2,952 at current rates. Victims who miss the five-day deadline see that figure double to 0.073920 BTC, or about $5,904. No free decryptor exists, and Synology has offered none. Affected users who do not have off-site backups are, for practical purposes, out of options.
Reports first surfaced in South Korea around October 28. Victims filed complaints with KISA, the country's internet security agency, but KISA declined to say how many devices were affected, what caused the intrusions, or what it was doing about them. Synology has similarly not disclosed how many users were hit, which device models were targeted, or when it first became aware of the campaign. A Taiwanese NAS research group that compiled damage cases found a common thread: in every instance they reviewed, the device's management interface was reachable directly from the internet, whether through router port forwarding, UPnP, QuickConnect, or a reverse proxy.
The attack timing is not coincidental. On October 25, four days before Synology issued its statement, a public proof-of-concept exploit for CVE-2024-10441 appeared on GitHub. That kind of public PoC typically compresses the window between disclosure and active exploitation to days, sometimes hours. Security researchers at 360 Security Team and Solar Emergency Response Team, who both published analysis on October 29, noted that the campaign appears to have kicked into gear almost immediately after the PoC dropped.
There is, however, a complication in Synology's explanation. The Solar team examined one affected device running DSM 7.4.1-90080 Update 1, a build that does not fit neatly into the SA-24:20 vulnerability timeline. The researchers have not ruled out other entry points, including vulnerable third-party packages, container services, or stolen credentials. No zero-day has been confirmed, but the mismatch has not been fully explained either.
Adding another layer, the 360 Security Team's analysis points to a different set of flaws entirely: CVE-2026-13639 and CVE-2026-13684, both scored 9.8, patched by Synology on September 18, 2026. Under 360's reading, these are "1-day" exploits built on patches that were barely a month old when the attacks began. If 360 is right, devices that only applied the 2024 patch would still be exposed.
Separately, Synology disclosed two more critical vulnerabilities in its PHP infrastructure, CVE-2026-109618 and CVE-2026-109619, affecting packages including Web Station, WordPress, Joomla, and phpMyAdmin. Synology says these flaws are not the C3RB3R entry point, but has advised users to patch them regardless. Security firm Genians found that 96 percent of internal-network devices running PHP were exposed.
Synology's guidance for users is practical if grim for those already affected. The company recommends running a Security Advisor scan, checking Task Scheduler for unfamiliar scripts, and reviewing User and Group settings for administrator accounts that were not created by the device owner. If either check turns up something unexpected, Synology says to contact its support team rather than attempt a manual cleanup. For everyone else, the advice is to update DSM immediately, enable automatic updates, and move backup jobs off-device using Hyper Backup or Snapshot Replication.
The patches for SA-24:20 are in DSM 7.2.1-69057-6, 7.2.2-72806-1, 7.2-64570-4, 7.1.1-42962-7, and 6.2.4-25556-8. Synology PSIRT says it continues to monitor the campaign.
.webp "Operation Endgame Disrupts Global Cyber Crime Assembly Line")
.webp)
