Synology, the Taiwanese maker of network-attached storage (NAS) appliances, is warning customers about an active wave of ransomware attacks against its devices. On 29 October 2026, Synology said threat actors are exploiting a vulnerability it patched in December 2024 to break into devices running outdated versions of its DiskStation Manager (DSM) operating system, encrypt the data on them and demand a ransom. On 2 November, the Hong Kong Computer Emergency Response Team Coordination Centre (HKCERT) issued its own ransomware alert on the same attacks and urged every owner to update.
The Red Tiger team is flagging this one for industrial organizations because Synology NAS boxes are everywhere in plants, often bought outside the IT budget and rarely patched.
Victims report that their files were encrypted, renamed with a .L0CK3D extension, and replaced by a ransom note called read-me3.txt that tells them to buy a "C3rb3r Decryptor" from a dark web site, according to BleepingComputer. C3RB3R, also called Cerber, is a ransomware strain that has been used since late 2021 against internet-facing servers that were behind on patches. BleepingComputer reports the first victim reports surfaced more than two weeks ago. Synology rarely issues warnings like this; its last one was in 2019.
Synology has not said publicly which vulnerability is being used. Its notice points owners to advisory Synology-SA-24:20, which covers three DSM flaws fixed between November and December 2024: CVE-2024-10441, a critical flaw (9.8 out of 10) that lets a remote attacker run code without logging in; CVE-2024-50629, which lets an attacker read certain files; and CVE-2024-10445, a weakness in how updates are checked. None of the three is in the Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) catalog as of its 30 October release. The fixed versions are DSM 7.2.2-72806-1, 7.2.1-69057-6, 7.2-64570-4, 7.1.1-42962-7 and 6.2.4-25556-8, or anything newer.
Separately, Synology has released PHP security updates for the PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619) for DSM 7.4, 7.3, 7.2, 7.1, 7.0 and 6.2, including versions that are otherwise end of life. These matter if the NAS runs PHP-based packages such as Web Station, WordPress, phpMyAdmin, MediaWiki, Calendar or MailStation. Synology has not said whether PHP2Shell plays any part in the ransomware attacks. The Shadowserver Foundation tracks more than 380,000 Synology NAS devices reachable from the internet, according to BleepingComputer.
On the plant floor and in the control room, a small Synology box is often the place where engineering workstation backups, programmable logic controller (PLC) and human-machine interface (HMI) project files, and historian exports end up. It is also a common recorder for security cameras through Synology Surveillance Station.
In the plant's business network and the buffer network between IT and operations, the same boxes act as file shares for maintenance records and drawings, and as targets for nightly backup jobs.
At the edge and in the cloud, owners often turn on QuickConnect, port forwarding or the DSM web page from the internet so contractors and staff can reach files from home. That exposure is exactly what these attacks look for. If the NAS holds the only good copy of a control system backup, losing it to ransomware can turn a routine recovery into days of rebuilding.
We are here to help, so check out our resources online at www.redtigersecurity.com and book a follow-up call with our team if you have any questions: https://calendly.com/jonathanpollet/30min
Sources: Synology notice (29 October 2026); Synology-SA-24:20; HKCERT ransomware alert (2 November 2026); BleepingComputer (2 November 2026)
Check out our resources and book a follow-up call with our team.
