A ransomware attack targeting the network-attached storage (NAS) devices of Taiwanese storage maker Synology is spreading in South Korea. The attackers encrypt stored photos and documents to make them unreadable, then demand bitcoin for their recovery, but neither the manufacturer nor authorities have offered a concrete recovery method.
According to industry sources on the 30th, reports of files stored on Synology NAS devices becoming inaccessible have been filed in South Korea since around the 28th. Users have also been reporting damage to the Korea Internet & Security Agency (KISA), a private-sector cyber incident response agency. Infected files are given a ‘.L0CK3D’ extension, and a ransom note in the form of a ‘read-me3.txt’ file is left in the folder. Because the file contents themselves are encrypted, renaming files or changing extensions will not restore photos and documents to a readable state.
What the attackers demanded was the purchase of a decryption program called “C3RB3R DECRYPTOR.” Payment is limited to bitcoin, with a five-day deadline. The demand is 0.036960 bitcoin (BTC), or about $2,952 (approximately 3.9 million won). The attackers threaten to double the demand to 0.073920 bitcoin, or about $5,904 (approximately 7.9 million won), after the deadline.
CategoryDemand (bitcoin)USD equivalentWon equivalentWithin deadline0.036960 BTC$2,952approximately 3.9 million wonPast deadline0.073920 BTC$5,904approximately 7.9 million won
Note: Won equivalents are based on the dollar amounts cited in the source material.
The attack vector is believed to be vulnerabilities in Synology’s own operating system, DiskStation Manager (DSM). Chinese security firm 360 said it had received multiple related requests through its ransomware response service and published an analysis of malware obtained from affected devices. According to the analysis, the attackers exploited two DSM vulnerabilities disclosed in September (CVE-2026-13639 and CVE-2026-13684) to break in, then encrypted files with “C3RB3R,” a variant of the existing Cerber ransomware. The flaws allow an outside attacker to read or modify files without logging in, and each received a score of 9.8 out of 10 on the Common Vulnerability Scoring System (CVSS).
Synology disclosed the attack on its official website and recommended a security update only after damage continued abroad and security firms had published their analyses. The company said it “confirmed ransomware attacks that exploit vulnerabilities for which a security patch was distributed in December 2024, targeting devices running older versions of DSM,” and “strongly recommends that all customers using vulnerable DSM versions update to the latest version immediately.” It advised isolating infected devices from the network and powering them off if they cannot be disconnected. For data recovery, it offered only guidance to restore using backup data or snapshots.
It did not, however, state a position on whether it possesses or is developing a decryption tool, on support for recovery costs, or on any compensation plan. It also did not disclose the scale of the damage in South Korea and abroad, the main affected models, or when it first became aware of the incident.
KISA is reportedly planning to review the reports, contact those who filed them and guide them on response measures. But when asked specifically about its response status, when the first attack occurred, the cause, the scale of damage and follow-up measures, it replied that it is “difficult to give a specific answer regarding the circumstances and cause of an intrusion incident involving a particular company or service, the scale of damage and the response status.”
Separately from this incident, security updates for the PHP vulnerability “PHP2Shell” are also under way across Synology’s product line. Synology confirmed that 10 PHP-based applications, including WordPress, Web Station and MailPlus Server, are affected and has released patches for each DSM version. KISA also flagged two vulnerabilities in Synology Calendar, MailPlus Server and PHP (CVE-2026-109618 and CVE-2026-109619) and recommended updating to the latest versions. The direct connection between this PHP vulnerability and the ransomware infections has not yet been confirmed.
South Korean security firm Genians warned that network equipment connected to corporate internal networks — including NAS devices, routers and firewalls — could be exposed to attacks exploiting the PHP2Shell vulnerability. An analysis of device identification data from its cloud network access control (NAC) platform found that 96% of devices running PHP on internal networks were exposed to the vulnerability, and 78% of the vulnerable devices were running outdated versions of PHP 8.1 or earlier that are no longer officially supported. The company noted that 89% of the identified devices were on private IP ranges unreachable from external internet search engines, making the risk hard to detect through external web server checks alone.
A NAS is a device connected to the internet or an internal network to store and share photos, videos and work documents, and is widely used not only for personal cloud storage but also as a corporate file-sharing and backup server. Because it serves as a backup repository used to recover data when originals are damaged, an attack on the NAS itself can encrypt the backups too, eliminating any recovery path. Synology is a company with more than 14 million systems deployed worldwide, and it has said its South Korean market revenue grew at an average double-digit rate over the past three years, with annual business-to-business (B2B) revenue rising more than 50%.
Security industry officials stress that external access settings and patch status should be checked first. “Because this is a device widely used to store important data, users should check whether external access is enabled and then apply security updates to prevent the spread of infections,” one security expert said. Others note that swift action is needed because an attack on corporate equipment can damage work documents and backups and spill over into business disruption.
Click Here For The Original Source.
——————————————————–
