Hackers are locking files on Synology storage boxes that skipped an update

Synology, the Taiwanese maker of network storage boxes, is warning owners that ransomware attackers are going after devices that never installed an old update. The company says the flaw was fixed in December 2024, but boxes running outdated software are still being hit. Ransomware locks your files and demands payment to unlock them.

What happened

These boxes are called NAS devices. They are small drives on a home or office network that hold shared files, backups and photos. They run Synology's DiskStation Manager software, or DSM. Synology said the attacks aim to encrypt data and extort ransom. Customers report a ransomware called C3RB3R, which adds a .L0CK3D ending to the names of locked files.

Synology did not name the exact flaw. It linked to a November 2024 advisory that lists three vulnerabilities. The company strongly urges everyone on a vulnerable version to update DSM right away and to turn on automatic updates.

Who should worry

Anyone with a Synology box that has not been updated in a long time. Owners who keep DSM current are not the ones described in Synology's warning. The alert box above lists the steps to take, and updating comes first.

This is not new for NAS devices. QNAP boxes were hit by ransomware in 2019, and Synology warned in August 2021 about attackers guessing common admin passwords. Synology has not said how many devices are affected, and it is not yet known whether more attacks are coming.