Add preferred source3
A ransomware attack targeting network-attached storage (NAS) devices made by Taiwan’s Synology is spreading in South Korea. The attackers encrypt files with a ‘.L0CK3D’ extension and demand 0.036960 bitcoin (approximately $2,952, or about 3.9 million won) for a decryption tool, threatening to double the demand to 0.073920 bitcoin (approximately $5,904, or about 7.9 million won) after a five-day deadline. Analysis points to two DSM vulnerabilities disclosed on Sept. 18 (CVE-2026-13639 and CVE-2026-13684), but Synology itself cites a flaw patched in December 2024, leaving attribution disputed. The two vulnerabilities allow unauthenticated remote reading and writing of files, so two-factor authentication offers no protection; users must upgrade DSM to 7.4-90075, 7.3.2-86009-4, 7.2.2-72806-9 or 7.2.1-69057-12 or later. Synology has only advised restoring from backups or snapshots and has offered no decryption tool or compensation, while KISA has not disclosed the scale of the damage.
Key Elements
A ransomware attack targeting network-attached storage (NAS) devices made by Taiwan’s Synology is spreading in South Korea. The attackers encrypt stored photos and documents to make them unreadable, then demand bitcoin for their recovery, but neither the manufacturer nor authorities have offered a concrete recovery method.
According to industry sources on the 30th, reports of files stored on Synology NAS devices becoming unreadable have been filed in South Korea since around the 28th. Users have also been reporting damage to the Korea Internet & Security Agency (KISA), the private-sector cyber incident response agency. Infected files are given a ‘.L0CK3D’ extension, and a ransom note in the form of a ‘read-me3.txt’ file is left in the folder. Because the file contents themselves are encrypted, changing file names or extensions will not allow photos and documents to open normally.
What the attackers are demanding is the purchase of a decryption program called ‘C3RB3R DECRYPTOR.’ Payment is limited to bitcoin, with a five-day deadline. The demand is 0.036960 bitcoin (BTC), or about $2,952 (approximately 3.9 million won). The attackers threaten to double the demand to 0.073920 bitcoin, or about $5,904 (approximately 7.9 million won), if the deadline passes.
| Category | Demand (bitcoin) | USD equivalent | KRW equivalent |
|---|---|---|---|
| Within deadline | 0.036960 BTC | $2,952 | approximately 3.9 million won |
| Past deadline | 0.073920 BTC | $5,904 | approximately 7.9 million won |
Note: KRW equivalents are based on the dollar amounts cited in the
The attack path is believed to be a vulnerability in Synology’s own operating system, DiskStation Manager (DSM). China’s 360, a security firm, said it had received multiple related requests through its ransomware response service and published an analysis of malware recovered from affected devices. According to that analysis, the attackers exploited two DSM vulnerabilities disclosed in September (CVE-2026-13639 and CVE-2026-13684) to break in, then encrypted files with ‘C3RB3R,’ a variant of the existing ransomware ‘Cerber.’ The flaws allow an outside attacker to read or modify files without logging in, and each received a score of 9.8 out of 10 on the Common Vulnerability Scoring System (CVSS). They stem from insufficient entropy in the login logic that makes sessions predictable (CWE-331) and inadequate SCGI output encoding (CWE-116), both of which can be exploited remotely without separate privileges or user interaction.
Attribution of the vulnerability, however, is disputed. Synology’s official position points to a flaw patched in December 2024 (Synology-SA-24:20), while 360’s analysis points to the two disclosed on Sept. 18, 2026. Both explanations reach the same conclusion — upgrade to the latest DSM — but if 360’s analysis is correct, devices that applied only the late-2024 patch remain exposed. Synology said in its September security advisory that there is no separate workaround.
What makes this vulnerability especially dangerous is that account takeover is not required. Attackers can read and write files with system privileges without successfully logging in, so account protections such as two-factor authentication, strong passwords and login-failure lockouts do not help defend against it. According to a compilation of disclosed damage cases by a Taiwanese NAS specialist outlet, the common thread was that the DSM management interface was reachable from the internet, via a variety of paths including router port forwarding, UPnP, QuickConnect and reverse proxies.
Synology disclosed the attack and urged security updates on its official website only after damage continued overseas and security firms published their analyses. The company said it “confirmed a ransomware attack that exploits a vulnerability for which a security patch was distributed in December 2024, targeting devices running older versions of DSM,” and “strongly recommends that all customers using vulnerable DSM versions immediately update to the latest version.” It advised isolating infected devices from the network and powering them off if they cannot be disconnected. For data recovery, it offered only guidance to restore from backup data or snapshots, and recommended keeping automatic updates turned on.
| DSM version | Fixed version |
|---|---|
| DSM 7.4 | 7.4-90075 or later |
| DSM 7.3 | 7.3.2-86009-4 or later |
| DSM 7.2.2 | 7.2.2-72806-9 or later |
| DSM 7.2.1 | 7.2.1-69057-12 or later |
Even with the same build number, a lower update number remains vulnerable. For example, 7.2.2-72806 must be at least 7.2.2-72806-9. DSM’s automatic updates do not upgrade across major versions, and there have been reports of older devices being shown as on the “latest version.”
Synology, however, did not take a separate position on whether it possesses or is developing a decryption tool, on recovery-cost support, or on a compensation plan. It also did not disclose the scale of the damage in South Korea or abroad, the main affected models, or when it first became aware of the incident.
No free decryption tool for C3RB3R has been identified so far, and commercially available recovery tools are said to be ineffective against this variant. The malware generates a separate 256-bit key for each file, encrypts it, and then wraps that key with an RSA-2048 public key, so files cannot be restored without the attacker’s private key.
KISA is reportedly planning to review the reports, contact those who filed them and guide them on response measures. Asked specifically about its response status, when the first attack occurred, the cause, the scale of damage and follow-up measures, however, it said, “We cannot provide specific answers regarding the circumstances and cause of an intrusion incident involving a particular company or service, the scale of damage, or our response status.”
The same vulnerability has already been publicized in Japan. JPCERT/CC introduced the DSM vulnerability in its weekly report on Sept. 30, and Synology’s Japan subsidiary issued a statement dated Oct. 29 urging DSM updates.
Separately from this matter, Synology’s product line is also receiving security updates for a PHP vulnerability called ‘PHP2Shell.’ Synology confirmed that 10 PHP-based applications, including WordPress, Web Station and MailPlus Server, are affected and has released patches for each DSM version. KISA also flagged two vulnerabilities in Synology Calendar, MailPlus Server and PHP (CVE-2026-109618 and CVE-2026-109619) and recommended updating to the latest versions. A direct link between this PHP vulnerability and the ransomware infections has not yet been confirmed.
South Korean security firm Genians warned that NAS devices, routers, firewalls and other network equipment connected to corporate internal networks could be exposed to attacks exploiting the PHP2Shell vulnerability. An analysis of device-identification data from its cloud network access control (NAC) platform found that 96% of devices running PHP on internal networks were exposed to the vulnerability, and 78% of the vulnerable devices were running outdated versions of PHP 8.1 or earlier that have reached end-of-support. The company noted that 89% of the identified devices were on private IP ranges unreachable from external internet search engines, making the risk difficult to detect through external web server checks alone.
NAS is a device connected to the internet or an internal network to store and share photos, videos and work materials, and is widely used not only for personal cloud storage but also as corporate file-sharing and backup servers. Because it serves as a backup repository used to recover data when originals are damaged, an attack on the NAS itself can encrypt the backups too, eliminating the recovery path entirely. Synology is a company with more than 14 million systems deployed worldwide.
Not every case is explained by this vulnerability. One incident response team said it recently identified a victim running a DSM 7.4-series build and has not yet ruled out other intrusion paths such as packages, containers or stolen credentials. That means a DSM update is clearly necessary, but not sufficient on its own to guarantee safety.
The security industry stresses that external access settings and patch status should be checked first. “Because this is equipment widely used to store important data, users should check whether external access is enabled and then apply security updates to prevent the spread of infections,” one security expert said. Others noted that if corporate equipment is attacked, damage to work materials and backups can spill over into business disruption, making swift action necessary.
