| Share With Your Network | Ransomware operators are encrypting files on Synology NAS devices and leaving a ransom note in every folder, and Synology has now named the flaw it believes is responsible. The company’s October 29 statement points to a vulnerability patched in December 2024, and it states plainly that the attacks rely on nothing else. 4–7 minutes That last part is the more interesting claim. Synology is not hedging. It says its investigation shows the campaign exploits only the flaw addressed in SA-24:20, and it explicitly rules out the recently patched PHP2Shell bugs, which had been widely assumed to be involved. Alert Summary ItemDetailRansomwareC3RB3R, a Cerber-family strain, encrypts files with a .L0CK3D extensionTargetSynology NAS systems running end-of-life DSM buildsSynology’s diagnosisCVE-2024-10441, CVSS 9.8, fixed in December 2024 under SA-24:20360’s diagnosisCVE-2026-13639 and CVE-2026-13684, both CVSS 9.8, fixed September 18, 2026Patched buildsDSM 7.4-90075, 7.3.2-86009-4, 7.2.2-72806-9, 7.2.1-69057-12Free decryptorNone published What the Malware Does C3RB3R has been encrypting files on Synology NAS hardware since early October. The analyzed sample skips 27 system directories and several file categories, then walks everything else recursively, generating a 256-bit key per file, encrypting with ChaCha8 and wrapping that key with RSA-2048. A list of 187 priority extensions gets full encryption, while other files are partly encrypted to shorten the run. Every encrypted file picks up the .L0CK3D suffix, and each folder receives a read-me3.txt with a six-digit ID and a Tor address. The demand starts at 0.036960 bitcoin, roughly $2,952, and doubles after five days. Backups stored on the same box go with everything else. The Dispute at the Center of It Synology’s statement describes a vulnerability patched in December 2024 and links to SA-24:20, which is CVE-2024-10441, an unauthenticated remote code execution bug rated 9.8 and found at Pwn2Own 2024 by DEVCORE researchers Pumpkin Chang and Orange Tsai. The DSM 6.2 fix shipped on December 5, 2024. 360 instead blames two critical bugs fixed on September 18, 2026, and calls the campaign a 1day operation built on a patch barely a month old. Only one of those readings can be right about the entry point, and Synology is now on record rejecting the newer one. There is a tidy explanation for Synology’s confidence. On October 25, a public writeup and proof of concept for the 2024 bug appeared on GitHub, four days before both advisories. A working exploit for an old flaw turns every unpatched box into a target overnight, and it explains why a two-year-old bug would suddenly be in active use. A Third Team Suspects a Zero-Day A response team identified as Solar reports one Synology NAS already running a recent DSM 7.4.1 build, which would not fit the 2024 theory. That team does not rule out add-on packages, containers or stolen credentials either, and no proof of a zero-day has been published. Nobody has produced a victim count. Korea’s KISA acknowledged reports but declined to describe scale. PHP2Shell Is a Separate Problem Synology devoted a full paragraph to decoupling the two, and the distinction matters for anyone deciding what to patch first. The PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619, both score 9.8 and allow unauthenticated remote code execution in any PHP instance serving web requests. Synology has shipped fixes across the DSM 7.4, 7.3, 7.2, 7.1, 7.0 and 6.2 branches. Affected packages include Web Station, WordPress, Joomla, MediaWiki, phpMyAdmin, MailStation, Calendar, KodExplorer and vtigerCRM. PHP 7.3 gets no fix because it is end of life, and MailStation needs a manual update through Package Center. That is a serious exposure in its own right, but it is not how C3RB3R is getting in. Every Synology NAS owner should patch both. What to Do Now Synology’s checklist is more useful than the generic advice. Start with a Security Advisor scan, then open Task Scheduler and look for scripts you did not create, and check User & Group for administrator accounts you did not add. Either one is a sign of intrusion, and Synology says to contact Support rather than attempt a cleanup. Then update DSM under Control Panel > Update & Restore and update every package in Package Center. Compare the full build string including the last digit, because a Synology NAS on 7.2.2-72806-1 has the 2024 patch but not the September one. Turn on automatic updates so future fixes land without a reminder, then set up an off-site copy using Hyper Backup or Snapshot Replication. A Synology NAS with snapshots only on the same box is a Synology NAS that loses them along with everything else. Confirm the backup tasks are actually completing, which is the step most people skip. Synology PSIRT says it is monitoring the campaign and its Support team is assisting affected users through Support Center in DSM. Key Takeaways C3RB3R is encrypting files on Synology NAS devices that have not been patched Synology says SA-24:20 is the only flaw exploited and rules out PHP2Shell A public exploit for the 2024 bug appeared four days before the warning Ransom starts near $2,952 and doubles after five days, with no decryptor Synology NAS owners should scan for intruders, patch, enable automatic updates, and back up off-site The Bottom Line The vendor and one of the incident responders disagree about the entry point, which means two different pools of victims and only one of them covered by an update from 2024. The cheapest insurance is to run the scan for unknown scripts and admin accounts, patch to the current build for the branch, and stop exposing the login page to the internet. Those steps hold regardless of which theory turns out to be right. What do you think about this Synology NAS ransomware campaign? Drop a comment on your favorite platform below, and let’s discuss! In some of our articles and especially in our reviews, you will find Amazon or other affiliate links. As Amazon Associates, we earn from qualifying purchases. Any other purchases you make through these links often result in a small amount being earned for the site and/or our writers. Techaeris often covers brand press releases. Doing this does not constitute an endorsement of any product or service by Techaeris. We provide the press release information for our audience to be informed and make their own decision on a purchase or not. Only our reviews are an endorsement or lack thereof. For more information, you can read our full disclaimer.
Click Here For The Original Source.
——————————————————–
