Synology confirms ransomware targeting old DSM; C3RB3R attribution not independently verified
Synology confirms ransomware exploitation of a vulnerability patched in December 2024 on devices running outdated DSM. The exact CVE, device count and C3RB3R attribution remain unconfirmed by the vendor's public text.
Updated: · Vietnam time (UTC+7)
Synology's 29 October 2026 notice, Synology-SA-24:20 and ThaiCERT's 3 November alert were checked. Ransomware activity against outdated DSM devices and the vendor's update instruction are confirmed. The exploited CVE, device count, initial-access path and C3RB3R attribution have not been independently verified; a .L0CK3D extension or ransom note alone is insufficient for family attribution. HKCERT and SA-26:14 were also reviewed; PHP2Shell has not been confirmed as the campaign’s entry point.
The source notice was published on 29 October; Ransomware.VN published this article on 5 November after reviewing the vendor and CERT material. The article date does not replace the event date. No private Ticket, customer data, malware sample or private leak-site material is used. If compromise is suspected, isolate and preserve evidence before changes that could destroy the timeline.
Evidence: Synology confirms ransomware targeting outdated DSM
On 29 October 2026, Synology said threat actors were exploiting a vulnerability patched in December 2024 to target devices running outdated DSM. The attacks aim to encrypt data and extort payment. [S1]
The vendor urges affected-version users to update DSM immediately and recommends automatic updates. This confirms ransomware activity rather than merely repeating a leak-site claim. [S1]
Evidence: Synology-SA-24:20 does not identify the exploited CVE
The notice points to Synology-SA-24:20, which lists CVE-2024-10441 for remote code execution, CVE-2024-50629 for limited file reading and CVE-2024-10445 for file writing under specified conditions. [S2]
The ransomware notice does not say which of the three is being used. Linking the advisory therefore must not be converted into a claim that one exact CVE is confirmed across every incident. [S1][S2]
C3RB3R / L0CK3D attribution needs more evidence
ThaiCERT records user reports associating the activity with the C3RB3R name, the .L0CK3D extension and a read-me3.txt ransom note. It also notes that Synology has not disclosed the number of devices or exact vulnerability. [S3]
The reviewed body of Synology's notice confirms ransomware but does not publicly name a family. Ransomware.VN therefore keeps C3RB3R attribution independently unverified: an extension, note or campaign name alone is not enough for family attribution.
Technical assessment: patch clean systems; preserve evidence when compromise is suspected
For a NAS with no suspicious signs, update DSM to the latest model-supported release, verify the post-reboot build and remove the management interface from direct Internet exposure. Patching reduces future exploitation risk but does not prove there was no prior access.
If extensions change, a ransom note appears, logins are anomalous or files change in bulk, isolate the NAS, document state and preserve logs/configuration before updating, restoring or resetting. Avoid further writes to affected volumes.
- Check DSM and packages per model; enable automatic updates where change controls permit.
- Remove direct Internet management exposure; use a trusted management network or VPN, MFA and separate administrator accounts.
- Verify an independent or offline backup and test restoration; a snapshot on the same NAS is not an independent survivable copy.
- Rotate credentials from a clean device when exposure is supported by evidence, and preserve evidence before rebuilding.
9 November source review: DSM and PHP2Shell fixes are separate
HKCERT’s 2 November alert distinguishes the flaw patched in December 2024 that Synology observed being exploited from the two PHP2Shell CVEs (CVE-2026-109618 and CVE-2026-109619). Synology has not confirmed a PHP2Shell link to these ransomware incidents. [S4][S5]
Check the DSM version against SA-24:20 and installed packages against the SA-26:14 table separately. Apply the appropriate PHP patch through Package Center; if Mail Station is installed, check for its manual package update. Package fixes on some end-of-life DSM branches do not restore full support for those branches. [S2][S4][S5]
What remains unverified
No reviewed primary source publicly confirms the exact exploited CVE, total affected NAS count, complete IOCs, encryption behavior, stolen data, decryption key or impact in Vietnam. This article does not publish or infer from any TUNGTEK customer Ticket.
Sources
Each source's scope and date are recorded separately when available. A citation does not independently verify every assessment.
Update history
· Initial publication from Synology's notice, SA-24:20 and ThaiCERT; confirmed ransomware activity is separated from independently unverified C3RB3R attribution.
· Added separate DSM and PHP2Shell package patch guidance from HKCERT and Synology-SA-26:14 without attributing the campaign to PHP2Shell. Retained URLs, publication date and images.
Corrections policy
