The technology manufacturer has warned of cyberattacks targeting NAS devices running vulnerable versions of its DiskStation Manager (DSM) operating system. The attacks aim to encrypt stored data and demand a financial ransom, once again highlighting the importance of storage system security.

Data security is once again in the spotlight. Ransomware attacks continue to pose a threat to businesses and individuals, particularly when they target systems that store critical information.

This time, the focus is on Synology, one of the leading manufacturers of network-attached storage solutions, whose devices are used in both home and business environments.

On October 29, 2026, the company published a security alert warning of attacks against devices still running outdated versions of DSM.

According to the official statement, attackers are exploiting a vulnerability for which a security patch had already been available since December 2024.

The manufacturer recommends immediately updating affected devices and enabling automatic updates.

What happened with Synology?

Synology has identified cyberattacks targeting certain NAS devices, with the aim of encrypting stored data and demanding a financial ransom in exchange for its supposed recovery.

The alert is related to ransomware activity that has put some users' storage systems at risk.

Technical information published by external researchers links this campaign to C3RB3R, a ransomware variant belonging to the Cerber family.

However, it is important to distinguish between the sources: Synology's statement confirms the attacks and the exploitation of a vulnerability, while the specific identification of C3RB3R comes from third-party investigations.

One of the most relevant aspects is that the manufacturer warns that the exploited vulnerability already had an available security fix.

This demonstrates that keeping systems up to date is not simply about adding new features, but rather a fundamental measure for preventing known vulnerabilities from continuing to pose a risk.

What is Synology and which devices may be affected?

Synology is a technology company specializing in network-attached storage solutions, data protection, business collaboration, and IT infrastructure management.

Among its best-known products are NAS devices, which are used to store and manage information across multiple devices connected to a network.

These devices can be found in small businesses and offices, as well as in large organizations and homes.

The security alert does not mean that all Synology products are affected. The risk is limited to devices running vulnerable versions of DSM.

For this reason, users should check which version they have installed and verify the updates available for their specific model.

What is DSM and why is it important for security?

DSM (DiskStation Manager) is the operating system developed by Synology for its NAS devices.

It can be compared to Windows on a computer or Android on a mobile phone: it is the software that allows users to manage and control the device's main functions.

Through DSM, users can:

• Manage files: Organize stored documents, folders, and files.
• Manage users: Create accounts, assign permissions, and control who can access information.
• Configure backups: Schedule backups and manage different data protection solutions.
• Manage applications: Install and manage additional tools.
• Control security: Configure connections, authentication, and various protection options.
• Manage storage: Monitor hard drives, volumes, and RAID configurations.

Precisely because of DSM's importance to the operation of a NAS device, keeping it up to date is essential.

Like any operating system, it may contain vulnerabilities that cybercriminals can exploit if they are not addressed through the appropriate updates.

What is C3RB3R ransomware?

Ransomware is a type of malware designed to prevent victims from accessing their files by encrypting them.

Attackers typically demand a financial payment in exchange for providing a supposedly effective tool to recover the information.

In the case of C3RB3R, published investigations link this threat to attacks targeting Synology NAS devices.

Affected files may become inaccessible, putting documents, photographs, databases, and other stored content at risk.

For a business, the consequences can go far beyond temporarily losing access to a few documents.

An attack of this nature can result in:

• Disruptions to business operations.
• Loss of access to important information.
• Financial costs associated with recovery.
• Potential exposure of confidential information.
• Reputational damage and loss of customer trust.
• Difficulties restoring operations if independent backups are not available.

According to technical investigations published by third parties, the C3RB3R ransomware campaign may be associated with two critical DSM vulnerabilities:

• CVE-2026-13639.
• CVE-2026-13684.

Both vulnerabilities are listed in security advisory Synology-SA-26:13, published on September 18, 2026.

How can you protect a Synology NAS against ransomware attacks?

In response to this situation, the manufacturer has urged users running vulnerable versions to update DSM immediately.

It also recommends enabling automatic updates to keep devices protected against future vulnerabilities.

The official advisory Synology-SA-26:13 identifies the following fixed versions:

In addition, there are several preventive measures worth considering:

1. Keep DSM up to date

Check which version your device is running and install the security updates available for your specific model.

2. Enable automatic updates

This helps reduce the risk of leaving the system outdated for extended periods.

3. Review remote access

Avoid unnecessarily exposing NAS administration services to the Internet. Whenever possible, use secure connections through a VPN.

4. Enable multi-factor authentication

Add a second layer of protection to make unauthorized access more difficult.

5. Use strong passwords

Avoid default passwords or reusing passwords across different services.

6. Maintain independent backups

Keep offline or immutable backups that allow you to recover your data in the event of an attack.

7. Follow the 3-2-1 backup rule

One of the most widely recommended strategies for protecting information is the 3-2-1 backup rule, which consists of maintaining:

• 3 copies of your data: The original file and two additional copies.
• 2 different storage media: Store information on two different types of devices or systems.
• 1 offsite copy: Keep at least one backup outside the primary location, for example, at another physical location or in the cloud.

Additionally, it is advisable for at least one backup to be offline or immutable, making it more difficult for a ransomware attack to encrypt or modify it.

It is also important to periodically verify that backups are working correctly and that data can be successfully restored.

A known vulnerability can remain a security risk

One of the most important aspects of this alert is that Synology warns about the exploitation of a vulnerability for which a security patch was already available.

This demonstrates that having a patch available does not guarantee that all devices are protected if their administrators fail to install it.

This situation is not limited to NAS devices. It can also affect servers, computers, business applications, and other systems connected to the Internet.

Keeping devices up to date should be part of every cybersecurity policy, regardless of the size of the organization.

Conclusion: Protecting your data means protecting your business

Synology's alert once again highlights the importance of keeping storage systems up to date and implementing appropriate security measures.

For many businesses, a NAS represents much more than a device containing several hard drives: it is where a fundamental part of their daily operations is stored.

That is why prevention, access monitoring, and independent backups are essential elements in reducing the impact of a potential cyberattack.

It is not just about preventing someone from accessing our data, but also about ensuring that we can recover it when we need it most.

Is your business prepared to deal with a ransomware attack?

Information security is a responsibility that affects every organization, not just its IT department.

Sources and documentation

Official statements and documentation