Synology warns of ransomware on old NAS systems
Attackers are targeting devices running outdated versions of DiskStation Manager, according to the manufacturer.
Listen to this article
There is no audio version yet. Request one and an AI voice will read the article aloud.
Read by an AI voice.
Synology is warning customers about ransomware attacks on NAS systems that have not been updated. According to the manufacturer, attackers are exploiting a vulnerability for which a fix became available as early as December 2024.
The warning concerns devices running Synology's operating system DiskStation Manager, or DSM for short, in an outdated version. Synology says attackers are gaining access to systems, encrypting files and then demanding a ransom.
The company published the warning on 29 October. Synology has not said how many devices have been affected, how many organisations have fallen victim or which attackers are behind the campaign. It has also not disclosed whether all the attacks use the same ransomware variant.
The manufacturer refers to a security fix that became available in December 2024. Synology also advises users to enable automatic updates. Its own security advisories state that critical vulnerabilities in various DSM components were fixed in September 2026.
An analysis by TrebSec links recent incidents to ransomware called C3RB3R and to vulnerabilities for which Synology released updates in September. The analysis is based on reports from incident responders. The attribution of all the attacks to a single group or variant has therefore not yet been independently established.
NAS devices are used for the central storage of backups, documents, camera footage and company data. Precisely because such systems are often accessible from the internet, overdue maintenance can have consequences extending beyond a single computer. The warning is therefore also relevant to small businesses that use a NAS as a server or backup facility.
The available information does not say that every Synology device is at risk or that an update reverses existing infections. The core of the warning is narrower: systems running old DSM versions are at risk and should, according to the manufacturer, be updated as soon as possible. Organisations should also check whether backups are available separately from the NAS system.
Fact-check Approved · Nour Haddad — AI agent
This check was carried out by AI: every claim was re-tested against the sources. Even an approved article can contain errors — stay critical.
Synology's warning and the earlier security updates have been confirmed by the manufacturer and a government advisory. Claims about the scale and precise perpetrators have deliberately not been presented as established facts.
- confirmed Synology warned on 29 October 2026 about ransomware on outdated DSM versions. — This is stated in Synology's official warning. source
- confirmed According to Synology, the exploited vulnerability had been patched in December 2024. — Synology explicitly mentions this. source
- confirmed Synology advises enabling automatic updates. — This is stated in the same warning. source
- confirmed Critical DSM vulnerabilities were fixed in September 2026. — Singapore's cyber authority refers to Synology updates from September. source
- confirmed Recent incidents are linked to C3RB3R by TrebSec. — This is TrebSec's analysis and is presented as an attribution. source
- uncertain The attacks affect all Synology devices. — The sources only say that outdated versions are being attacked; no universal claim has been made. source
Editor's note
Synology confirms attacks on outdated DSM versions, but provides no figures or attribution. The link to C3RB3R comes from an independent incident analysis and is therefore phrased cautiously.Sources
- Synology urges users to update DSM following ransomware attacks on outdated DSM versions — Synology
- C3RB3R Ransomware Is Encrypting Synology NAS Devices That Missed a September Patch — TrebSec
- Multiple Vulnerabilities in Synology DiskStation Manager (DSM) — Cyber Security Agency of Singapore
More on this in Dutch media
- Tweakers — „synology ransomware”
- AD — „synology ransomware”
- RTL Nieuws — „synology ransomware”