Malaysia’s national cybersecurity response organization, MyCERT, has issued a critical warning about a large-scale C3RB3R ransomware campaign targeting internet-exposed Synology network-attached storage (NAS) devices. Synology confirmed on October 29, 2026, that attackers were exploiting a vulnerability patched in December 2024 to encrypt files and demand ransom payments. MyCERT’s November 7 advisory identified encrypted files carrying the .L0CK3D or .LOCK3D extension and ransom notes named read-me3.txt. No publicly available general decryptor has been confirmed for this ransomware variant.
ATTACKERS EXPLOIT OUTDATED SYNOLOGY SOFTWARE
Cybercriminals are targeting Synology devices running outdated DiskStation Manager (DSM) software, exploiting security weaknesses that can allow unauthorized access and file manipulation. Synology linked the attacks to vulnerabilities addressed in its December 2024 security updates, although the exact vulnerability exploited in every incident remains unconfirmed. The campaign poses significant risks to businesses that rely on NAS devices for sensitive documents, shared files, surveillance recordings, and critical backups.
RANSOMWARE THREATENS BUSINESS DATA AND BACKUPS
The C3RB3R ransomware campaign presents a serious threat because compromised NAS devices can contain both operational data and the backups organizations depend on for disaster recovery. Attackers can encrypt stored files, potentially disrupt business operations, and demand payment for restoration. MyCERT has characterized the campaign as mass exploitation of internet-accessible systems, although the total number of victims remains undisclosed. Organizations without offline or immutable backups could face prolonged outages and permanent data loss.
SYNOLOGY URGES IMMEDIATE SECURITY UPDATES
Synology and MyCERT are urging administrators to install the latest supported DSM security updates, restrict public access to management interfaces, enable multifactor authentication, and secure remote connections through VPNs. Organizations should investigate suspicious login activity, unusual file modifications, and known ransomware indicators. Devices suspected of compromise should be isolated and examined before restoration because installing patches does not eliminate existing malware or attacker access. With active attacks confirmed, administrators should prioritize patching vulnerable systems and protecting critical backups.