Synology has warned that attackers are exploiting a vulnerability patched in December 2024 to target network-attached storage devices running outdated versions of its DiskStation Manager (DSM) software. The company said the attacks aim to encrypt stored data and extort a ransom, but did not disclose how many devices were affected.
Chinese security firm Qihoo 360 separately reported that its anti-ransomware team had received multiple Synology NAS cases since October and identified the ransomware as C3RB3R, a variant of Cerber. Its analysis found encrypted files renamed with the .L0CK3D extension and ransom notes named read-me3.txt. 360 attributed the cases it examined to CVE-2026-13639 and CVE-2026-13684, two critical DSM vulnerabilities fixed in Synology’s September 18 security advisory.
The accounts differ on the entry point. Synology’s October 29 statement points to its older SA-24:20 advisory, which covers CVE-2024-10441, CVE-2024-50629 and CVE-2024-10445. The company has not named a specific CVE in the ransomware warning, while 360 links its investigated incidents to the two 2026 flaws in SA-26:13.
Qihoo 360’s report says the September flaws were used in attacks against unpatched devices. The advisory lists fixes in DSM 7.4-90075, 7.3.2-86009-4, 7.2.2-72806-9 and 7.2.1-69057-12. Synology’s 2024 advisory lists fixes for older DSM branches, including 7.2.2-72806-1, 7.2.1-69057-6, 7.2-64570-4, 7.1.1-42962-7 and 6.2.4-25556-8.
BleepingComputer reported that the first victim reports surfaced more than two weeks before its November 2 article. The public statements do not establish whether the differing vulnerability attributions describe separate attacks or overlapping victims.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
