Researchers can see more than 380,000 Synology NAS devices on the open internet. No one can say how many are still unpatched, but the attacks Synology just warned about are hitting the ones that are. The problem is, attackers can see the same list.
Synology’s Warning
On October 29, Synology told customers that attackers are exploiting a flaw it patched in December 2024 to encrypt NAS devices running outdated versions of its DiskStation Manager (DSM) software. Victims are finding their files renamed with a .L0CK3D extension and a ransom note called read-me3.txt, demanding payment for something called the “C3rb3r Decryptor.”
Synology hasn’t said which vulnerability is being used. Its advisory covers flaws that allow code execution, file reading, and file writing, and the fixes have been available for almost two years. So the devices getting hit are the ones that never got the update.
The Shadowserver Foundation tracks more than 380,000 Synology NAS devices reachable from the internet. Nobody knows how many of those are already patched, and some are probably research honeypots. It’s still a lot of targets.
Synology rarely issues warnings like this. The last one was in August 2019, after brute-force attacks spread eCh0raix ransomware. When a vendor breaks a seven-year silence, take the hint.
Not sure whether your NAS is visible from the internet? An external vulnerability scan will tell you in a few days, before an attacker’s scanner does. Let’s talk about what that looks like for your network.
Why NAS Devices Attract Ransomware
They hold so much information. They store shared drives, accounting files, customer records, and often backups too. One encrypted box can stop a small business cold.
Nobody specifically owns them. A server in a data center has a team watching it. A NAS usually belongs to whoever set it up three years ago, and they may not work there anymore. Updates often need a human to click a button, so they don’t happen.
Additionally, they’re convenient to reach. Many owners turn on remote access so staff can grab files from home. That also exposes the admin login page to anyone on the internet.
Finally, attackers don’t need to know you. They scan the internet in bulk for devices with known flaws. Your company never has to be on anyone’s target list. Your NAS just has to be running old software.
Copying Files to a NAS Doesn’t Mean They Are Backed Up
Plenty of businesses use a NAS as their backup. Computers copy to it every night, and everyone feels covered.
But the NAS sits on the same network, behind the same logins, reachable by the same ransomware. If an attacker hits the NAS directly, the original files and the “backup” go down together. If ransomware hits a PC that has the NAS mapped as a drive, it can reach across and encrypt that too.
A backup you can count on has at least one copy that the NAS (and anything on your network) can’t touch, either offline or offsite. It also has a restore you’ve tested at least once. If you’ve never restored a file from it, you don’t know yet whether it works.
A Short Checklist for NAS Owners
- Find every NAS and storage box on your network. Write down who set each one up and who is responsible for it now.
- Check the DSM version and update it. Synology lists these fixed releases or later: DSM 7.2.2 (7.2.2-72806-1), DSM 7.2.1 (7.2.1-69057-6), DSM 7.2 (7.2-64570-4), DSM 7.1 (7.1.1-42962-7), and DSM 6.2 (6.2.4-25556-8). Turn on automatic updates while you’re in there.
- Close the admin page to the internet. Look at your router for port forwarding rules pointing at the NAS. If staff need remote access, put a VPN in front of it.
- Lock down the logins. Turn on two-step verification for admin accounts, and retire any default or shared admin login.
- Make sure the NAS is backed up. Offsite or offline, then restore a file from it to prove it works.
- Look for trouble. Files ending in .L0CK3D or a read-me3.txt file mean you’ve been hit. Disconnect the device from the network and call your IT provider before you do anything else. Check your cyber insurance policy too, because most carriers want to hear about an incident within a day or two.
One More Thing
Many small businesses have at least one forgotten box like this. It might be a NAS, a camera system, a printer, or an old server in the corner. The common thread is that nobody updates it because nobody remembers it’s there.
If you’d like to know what an attacker would see when they look at your network from the outside, we’re glad to show you. MainNerve has been doing this work for over 20 years. Contact us today for a free consult.
