Synology NAS users are facing reports of a ransomware attack that can lock files and backups on their devices. The malware, known as L0CK3D or C3RB3R, has reportedly hit many storage systems, leaving victims unable to access their data.
One sign of a possible infection is a strange new file ending. Documents may show .L0CK3D or .L0CK3D. after their names, while a file called read-me3.txt appears with C3RB3R INSTRUCTIONS inside.
And the reported damage isn't limited to personal photos or a few shared folders. Users have allegedly lost access to work files, software projects, database images, and backup data stored on their NAS units.
According to HKEPC, Synology has acknowledged the reported attack and urged customers to install the latest DSM updates. That claim still needs direct confirmation from the company.
Here's the worrying part. The report suggests that infected Windows PCs aren't the main way this malware spreads. Instead, attackers appear to be targeting NAS devices that people have made reachable from the internet.
Investigators reportedly found two paths into these systems, each tied to remote code execution flaws rated 10.0 on the CVSS scale. Such flaws can let an attacker run code without having physical access to a device.
The first alleged route involves Docker containers. Some businesses use Synology Container Manager to host GitLab, Confluence, and other web apps, with network ports left open for outside access.
Two GitLab flaws, CVE-2026-110264 and CVE-2026-97229, are named in the report. Attackers may be able to exploit unsafe container permissions or escape flaws to reach parts of the host system.
From there, malicious code could be placed in Linux crond tasks. That would let the attack run at a later point rather than start as soon as the system is breached.
Another alleged entry path affects Synology's native apps. The report points to advisory Synology-SA-26:14 and two PHP flaws, CVE-2026-109618 and CVE-2026-109619.
These bugs are referred to as PHP2Shell and are said to affect MailStation, Synology Calendar, and other packages. The claim is that an exposed service could allow an intruder to plant malware without valid login details.
Once active, L0CK3D reportedly searches mounted drives from the Linux root directory. Storage paths such as /volume1 and /volume2 may be within its reach.
Even local backups might not escape. Hyper Backup data kept on the same device could get encrypted if it lacks protected file versions or proper separation from the main storage.
As for the encryption itself, the report describes RSA-4096 paired with AES or ChaCha20. No broadly available free tool has been identified in the account for restoring files locked by this attack.
For NAS devices that remain unaffected, the advice is to cut network access as a precaution. HKEPC suggests unplugging the network cable or blocking SMB traffic at the router to limit exposure.
If the admin panel still works, the report advises users to halt containers and pause Hyper Backup and Cloud Sync. It also warns against rushing into file cleanup or changing the storage layout.
Already infected systems need a different approach. Victims are advised to keep the ransom message, SSH records, and container logs intact, since these may help reveal what took place.
And wiping the NAS straight away could destroy useful evidence. The report cautions against reinstalling DSM or resetting drives before the incident has been examined.
Those records may help trace the entry point, identify how files were locked, and support a report to Synology. The exact attack paths and vulnerability claims still need independent verification, but the reported risks make exposed NAS services worth checking carefully.
One sign of a possible infection is a strange new file ending. Documents may show .L0CK3D or .L0CK3D. after their names, while a file called read-me3.txt appears with C3RB3R INSTRUCTIONS inside.
And the reported damage isn't limited to personal photos or a few shared folders. Users have allegedly lost access to work files, software projects, database images, and backup data stored on their NAS units.
According to HKEPC, Synology has acknowledged the reported attack and urged customers to install the latest DSM updates. That claim still needs direct confirmation from the company.
Here's the worrying part. The report suggests that infected Windows PCs aren't the main way this malware spreads. Instead, attackers appear to be targeting NAS devices that people have made reachable from the internet.
Investigators reportedly found two paths into these systems, each tied to remote code execution flaws rated 10.0 on the CVSS scale. Such flaws can let an attacker run code without having physical access to a device.
The first alleged route involves Docker containers. Some businesses use Synology Container Manager to host GitLab, Confluence, and other web apps, with network ports left open for outside access.
Two GitLab flaws, CVE-2026-110264 and CVE-2026-97229, are named in the report. Attackers may be able to exploit unsafe container permissions or escape flaws to reach parts of the host system.
From there, malicious code could be placed in Linux crond tasks. That would let the attack run at a later point rather than start as soon as the system is breached.
Another alleged entry path affects Synology's native apps. The report points to advisory Synology-SA-26:14 and two PHP flaws, CVE-2026-109618 and CVE-2026-109619.
These bugs are referred to as PHP2Shell and are said to affect MailStation, Synology Calendar, and other packages. The claim is that an exposed service could allow an intruder to plant malware without valid login details.
Once active, L0CK3D reportedly searches mounted drives from the Linux root directory. Storage paths such as /volume1 and /volume2 may be within its reach.
Even local backups might not escape. Hyper Backup data kept on the same device could get encrypted if it lacks protected file versions or proper separation from the main storage.
As for the encryption itself, the report describes RSA-4096 paired with AES or ChaCha20. No broadly available free tool has been identified in the account for restoring files locked by this attack.
For NAS devices that remain unaffected, the advice is to cut network access as a precaution. HKEPC suggests unplugging the network cable or blocking SMB traffic at the router to limit exposure.
If the admin panel still works, the report advises users to halt containers and pause Hyper Backup and Cloud Sync. It also warns against rushing into file cleanup or changing the storage layout.
Already infected systems need a different approach. Victims are advised to keep the ransom message, SSH records, and container logs intact, since these may help reveal what took place.
And wiping the NAS straight away could destroy useful evidence. The report cautions against reinstalling DSM or resetting drives before the incident has been examined.
Those records may help trace the entry point, identify how files were locked, and support a report to Synology. The exact attack paths and vulnerability claims still need independent verification, but the reported risks make exposed NAS services worth checking carefully.
