Synology makes the small file-storage boxes a lot of offices use for shared drives and backups. If you've got one, check it today.
Synology says ransomware is hitting boxes that haven't been updated. Ransomware is the kind of attack that locks up your files and demands payment. The way in is a security hole they fixed back in December 2024.
What happened
On October 29, 2026, Synology put out a notice telling customers to update. It says attackers are using a weakness patched in December 2024 to break into Synology boxes running old versions of their operating system, called DSM (DiskStation Manager). Once in, they lock the files and demand a ransom.
BleepingComputer reports the ransomware is called C3RB3R (also known as Cerber). Locked files get ".L0CK3D" added to the end of their names, and a note called "read-me3.txt" demands payment for a decryption tool. Victims started reporting attacks more than two weeks before Synology's notice. BleepingComputer also notes this is the first time since 2019 that Synology has put out this kind of attack warning.
What this means in plain English
A Synology box is a small computer that does one job: hold your files and share them around the office. Like any computer, it gets security updates. Skip them for a couple of years and you've got a front door with a broken lock that every burglar has a map to.
If the box's management page can be reached from the internet, attackers don't need to trick anybody. They find the box, use the known hole, and scramble every file on it. Your shared drive, your scanned invoices, your backups. All unreadable until you pay or restore from somewhere else.
Why a small business should care
These boxes are popular with small offices because they're cheap and they just work. That's also the problem. They sit in a closet for years and nobody logs in to update them.
And a lot of offices use the Synology box as their only backup. If ransomware locks it, the backup is gone too. That's the bigger problem.
Who's affected
Synology boxes running DSM versions older than these. Pass this list to whoever looks after yours:
DSM 7.2.2: update to 7.2.2-72806-1 or later
DSM 7.2.1: update to 7.2.1-69057-6 or later
DSM 7.2: update to 7.2-64570-4 or later
DSM 7.1: update to 7.1.1-42962-7 or later
DSM 6.2: update to 6.2.4-25556-8 or later
These come from Synology's advisory Synology-SA-24:20, which Synology pointed to when BleepingComputer asked. If yours is on anything older, it's well past due.
What to do: everyone
Find out if your office has a Synology box. It's often a small black box in the server closet or under a desk.
Ask whoever looks after it to run the system update today.
If you see files ending in ".L0CK3D" or a "read-me3.txt" note, stop and call your IT provider right away. Don't delete anything.
What to do: if you run the business
Get the box updated and turn on automatic updates, as Synology recommends.
Make sure the box's management page isn't reachable from the internet.
Get a second copy of your important files somewhere separate from the Synology box: offsite, or in a backup service that ransomware on your network can't touch.
Test that you can actually restore from that backup.
Questions to ask your IT provider
What DSM version is our Synology on, and are automatic updates turned on?
Can the box's admin page be reached from outside our office?
If this box got locked tomorrow, where would we restore our files from, and how long would it take?
Sources
Synology: Synology urges users to update DSM following ransomware attacks on outdated DSM versions
BleepingComputer: Synology warns of C3RB3R ransomware attacks targeting NAS devices
Contact Nautalex to see how we can help you with securing your file server.
