Synology NAS Ransomware: Update DSM Now to Stop the Attacks
Synology says ransomware attacks are targeting NAS devices on outdated DSM. Here are the safe DSM builds, the steps to lock down your NAS and what to do if files are already encrypted.
Image: TeQBlogs
Synology NAS ransomware attacks are hitting storage boxes that still run outdated DiskStation Manager (DSM) software. On 29 October 2026, Synology said attackers are using a flaw it patched in December 2024 to encrypt data and demand a ransom. The fix is simple: update DSM to a patched build now, switch on automatic updates and take the NAS off the open internet.
Quick summary
- What happened: Synology confirmed ransomware attacks on NAS devices running old DSM versions (press release, 29 October 2026).
- Which flaw: a vulnerability patched in December 2024. Synology points to advisory Synology-SA-24:20 but has not said which of its three CVEs is being used.
- Who is at risk: anyone running DSM 7.2.2, 7.2.1, 7.2, 7.1 or 6.2 below the fixed builds listed below, especially if the NAS is reachable from the internet.
- What to do: update DSM, update PHP in Package Center if you use web packages, close port forwarding and keep an offline backup.
- Name: security researchers have reportedly tracked the campaign as “C3RB3R” ransomware; Synology’s own notice does not name the malware.
What is the Synology NAS ransomware attack?
It is a ransomware campaign aimed at Synology network-attached storage (NAS) boxes that were never updated. Synology says threat actors are “exploiting a vulnerability patched in December 2024” to target devices on outdated DSM, with the goal of encrypting files and extorting a ransom.
Also read: Android SMS of Death Bug: Is Your Phone at Risk and How to Stay Safe
Hong Kong’s computer emergency response team, HKCERT, issued its own ransomware alert on 2 November 2026. It adds that the attacks target devices running end-of-life DSM versions. Victim numbers, ransom amounts and the group behind the campaign have not been officially confirmed.
This matters in India because small offices, CA firms, clinics, studios and home users often use a NAS as their only copy of important data. A NAS that has been forwarded to the internet for remote access and left on an old DSM build is exactly what this campaign looks for.
Which DSM versions are safe?
Your NAS is protected against the flaws in Synology-SA-24:20 if it runs at least the build shown below for your DSM line. The full build number matters: for example, 7.2.1-69057-5 is still vulnerable, while 7.2.1-69057-6 is fixed.
| DSM version | Severity (Synology) | Minimum fixed build |
|---|---|---|
| DSM 7.2.2 | Critical | 7.2.2-72806-1 or later |
| DSM 7.2.1 | Critical | 7.2.1-69057-6 or later |
| DSM 7.2 | Critical | 7.2-64570-4 or later |
| DSM 7.1 | Critical | 7.1.1-42962-7 or later |
| DSM 6.2 | Moderate | 6.2.4-25556-8 or later |
The advisory covers three CVEs: CVE-2024-10441 (critical, CVSS 9.8), CVE-2024-50629 (moderate) and CVE-2024-10445 (moderate). Because Synology has not said which one is being exploited, treat all three as in scope. If your model supports DSM 7.3 or 7.4, moving to the newest release is the better choice.
How to protect your Synology NAS from ransomware
Updating DSM closes the hole the attackers use, and the other steps limit the damage if something else goes wrong. Do them in this order.
- Check your DSM version. Sign in to DSM and open Control Panel > Info Center. Note the full DSM build number and compare it with the table above.
- Update DSM. Go to Control Panel > Update & Restore > DSM Update and install the latest version offered for your model.
- Turn on automatic updates. In the same DSM Update section, open the update settings and allow important updates to install automatically, as Synology recommends.
- Update PHP if you use web packages. Open Package Center and install the PHP security update (see the PHP2Shell section below).
- Close direct internet access. Remove router port forwarding to the DSM login page and use a VPN for remote access instead.
- Lock down accounts. Disable unused accounts, use strong unique passwords and turn on two-factor sign-in for administrators.
- Keep an offline backup. Keep at least one copy of important data on a drive or cloud backup that the NAS cannot overwrite, and test a restore.
For offices that cannot afford downtime, a planned backup and recovery setup is worth reviewing now. Suprams has a short guide to backup and disaster recovery for businesses, and our earlier explainer on backup solutions covers the basics.
What if your NAS model is end-of-life?
An end-of-life NAS no longer gets regular DSM updates, so it stays exposed to new flaws. Synology now describes DSM 7.2, 7.1, 7.0 and 6.2 as end-of-life versions.
If your box cannot move to a supported DSM version, HKCERT advises planning a replacement. Until then, keep it off the internet, install every update that is still offered and make sure its data is backed up elsewhere.
Is the PHP2Shell flaw linked to these attacks?
Not as far as anyone has confirmed. HKCERT says Synology has not confirmed whether PHP2Shell was involved, but it still advises installing those fixes.
Synology says the PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619) only affect NAS units running certain PHP-based packages: Calendar, IDrive, Joomla, KodExplorer, MailStation, MediaWiki, phpMyAdmin, vtigerCRM, Web Station and WordPress. PHP security updates are available in Package Center for DSM 7.4, 7.3, 7.2, 7.1, 7.0 and 6.2. Dependent packages restart on their own, but MailStation must be updated manually. On DSM older than 6.2, Synology recommends temporarily disabling these packages.
What to do if your files are already encrypted
Isolate the NAS first and avoid making things worse. Updating DSM after an attack will not decrypt files that are already locked.
| Do | Avoid |
|---|---|
| Unplug the NAS from the network and pause sync and backup jobs linked to it | Resetting, formatting or repeatedly restarting the device |
| Keep the ransom note, sample encrypted files and logs | Deleting logs or running random clean-up scripts |
| Contact Synology support or an incident-response provider | Assuming that paying the ransom will get your data back |
| Restore from a clean backup only after the system is patched and passwords are reset | Reconnecting the NAS to the internet before it is fixed |
Businesses in India should also check whether they need to report the incident to CERT-In. Our guide on anti-ransomware software explains how ransomware usually spreads, and common cyber security threats covers other risks to watch.
Frequently asked questions
Is my Synology NAS affected by the ransomware attacks?
It is at risk if it runs a DSM build older than the fixed builds in Synology-SA-24:20, such as anything below 7.2.1-69057-6 on DSM 7.2.1. Check the exact build in Control Panel > Info Center.
Will updating DSM recover encrypted files?
No. Updating stops the known flaw from being used again, but it does not decrypt anything. Recovery depends on a clean backup.
Is C3RB3R the official name of this ransomware?
The campaign has reportedly been tracked as C3RB3R by security researchers. Synology’s press release does not name the malware.
Is it safe to access my NAS remotely?
It is much safer through a VPN than through open port forwarding to the DSM login page. HKCERT advises against exposing NAS management interfaces directly to the internet.
Bottom line
This attack uses a flaw that has had a fix since December 2024, so most victims will be NAS boxes that were never updated. Spend five minutes today checking your DSM build, update it, turn on automatic updates, close port forwarding and confirm you have a backup the NAS cannot touch. If your model is end-of-life, plan its replacement now. For business AI risks, see our guide to AI agent security.
Sources
- Synology: Synology urges users to update DSM following ransomware attacks on outdated DSM versions (29 October 2026)
- Synology Security Advisory Synology-SA-24:20
- Synology: PHP2Shell security updates extended to end-of-life DSM versions
- HKCERT: Ransomware attacks targeting Synology NAS devices (2 November 2026)
About The Author
