The files are being locked, but key details are still missing
Reports from affected users describe files renamed with a .L0CK3D extension and a ransom note demanding payment for a “C3rb3r Decryptor.” Synology says the attackers are targeting devices running outdated DSM software. It has not said which specific vulnerability they’re exploiting, or how many devices have been affected.
That uncertainty matters. A Synology advisory lists several vulnerabilities fixed in December 2024, but there’s no confirmation that any particular one is behind these attacks. Don’t assume a specific CVE is the answer just because it appears in the advisory.
If your NAS holds shared business files, this is worth checking today. The box that quietly stores everyone’s working documents can become a very loud problem when those files suddenly won’t open.
Check your DSM version, then close the easy doors
Synology recommends updating DSM and enabling automatic updates. Its advisory lists these minimum fixed releases; where possible, install the latest version available for your device:
- DSM 7.2.2: 7.2.2-72806-1 or later
- DSM 7.2.1: 7.2.1-69057-6 or later
- DSM 7.2: 7.2-64570-4 or later
- DSM 7.1: 7.1.1-42962-7 or later
- DSM 6.2: 6.2.4-25556-8 or later
Also check that the DSM management interface isn’t exposed directly to the internet. And take a hard look at your backups: if the NAS is the only place your “backup” lives, you may have one copy of your data, not a recovery plan.
If you see the ransom note, don’t treat it as routine patching
If files have the .L0CK3D extension or you find the reported ransom note, isolate the NAS from the network and get help investigating before attempting recovery. Keep other backup copies disconnected until you know they’re clean. Updating is important, but a patch won’t tell you whether someone already got in.
For the vendor’s guidance and the fixes, see Synology’s warning and its security advisory. BleepingComputer’s report describes the ransom note and file extension reported by victims.
If you’re not sure whether your NAS is exposed or your backups would survive an incident, let’s check before you need them.
Book a 15-minute security check
We’ll help you identify what to check first, with no obligation.