Multiple South Korean Synology NAS hit by ransomware attacks; attackers demand approximately 0.037 coins BTC

AT A GLANCE

Multiple Synology NAS ransomware attacks have occurred in South Korea; files on older-version DSM devices were encrypted, and Bitcoin ransoms were demanded.

Article

South Korean Synology NAS hit by ransomware attacks; hackers demand payment of approximately 0.037 coins BTC to recover data

BlockBeats News,October 30, according to ChosunBiz, South Korea has recently seen multiple ransomware attacks targeting Synology network-attached storage devices (NAS). Attackers exploited vulnerabilities in Synology DiskStation Manager (DSM) to infiltrate devices and encrypt users' stored photos, files, and other data. Affected files are appended with the ".L0CK3D" extension. The attackers demand that victims pay 5 days 0.036960 coins of BTC, equivalent to approximately 2952 USD(approximately 4000000 Korean won), to purchase a decryption tool called "C3RB3R DECRYPTOR"; if payment is not made by the deadline, the ransom will double to 0.073920 coins of BTC, equivalent to approximately 5904 USD(approximately 8000000 Korean won).

Chinese cybersecurity company 360 found through analysis that the attackers may have exploited September disclosed by Synology this year DSM vulnerabilities (CVE-2026-13639 and CVE-2026-13684) to infiltrate devices and used a ransomware variant called C3RB3R to encrypt files. Both vulnerabilities allow external attackers to read or modify files without logging in, and their CVSS severity scores were both 9.8 out of 10. Synology stated that the attacks target devices running older versions of DSM and advised users to upgrade immediately to the latest version.

For infected devices, it is recommended to disconnect them from the network or shut them down, and restore data from previous backups or snapshots. Synology has not yet announced a decryption tool, recovery-cost support, or compensation plan. The Korea Internet & Security Agency (KISA) has been receiving user reports of victimization since around October 28 and is preparing to provide technical support, but has not disclosed the specific scale of victims or the handling of the incident. The report noted that the actual scale of losses caused by the attacks remains unclear, and work files and backup data in enterprise NAS may also be affected.

Original link https://m.theblockbeats.info/flash/374658

Key points

According to ChosunBiz, South Korea has recently seen multiple ransomware attacks targeting Synology (Synology)NAS.
Affected files are appended with the ".L0CK3D" extension.
Attackers demand that victims pay within 5 days 0.036960 coins BTC, equivalent to approximately 2952 USD or 4000000 Korean won.
If payment is not made by the deadline, the ransom will double to 0.073920 coins BTC, equivalent to approximately 5904 USD or 8000000 Korean won.
360 Analysis suggests that the attackers may have exploited CVE-2026-13639 and CVE-2026-13684 DSM vulnerabilities, and used C3RB3R a ransomware variant to encrypt files.
Both vulnerabilities allow external attackers to read or modify files without logging in; their CVSS scores were both 9.8 points.
Synology stated that the attacks target devices running older versions of DSM and advised users to upgrade immediately to the latest version.
For infected devices, the report recommends disconnecting them from the network or shutting them down, and restoring data from previous backups or snapshots.
Synology has not yet announced a decryption tool, recovery-cost support, or compensation plan.
KISA Since October 28 it has been receiving user reports of victimization and is preparing to provide technical support.

AI-assisted interpretation

The following is analysis, separate from reported facts. Verify important claims independently.

This is a ransomware incident targeting network storage devices: after entering certain older-version DSM devices, attackers encrypt files and then demand that users pay BTC to purchase a decryption tool called "C3RB3R DECRYPTOR". The report recommends that uninfected users upgrade DSM; infected devices should be disconnected from the network or shut down, and recovery from existing backups or snapshots should be attempted.

Why it matters to readers

NAS May store photos, files, enterprise work materials, and backups; once files are encrypted, users may be unable to access this data normally. The report also stated that work files and backup data in enterprise NAS may also be affected.

If you use Synology NAS, you should check whether DSM is the latest version. If the device is already infected, the report recommends first disconnecting it from the network or shutting it down, then checking whether previous backups or snapshots are available for recovery.

Risks and unknowns

Whether the attackers actually infiltrated through CVE-2026-13639 and CVE-2026-13684 remains unconfirmed; the original text only states that they "may have exploited" them.
The specific number of affected devices and the scale of impact have not yet been disclosed.
The actual scale of losses caused by the attack remains unclear.
KISA Specific incident response details have not yet been disclosed.
Synology has not yet announced a decryption tool, recovery cost support, or compensation plan.

Multiple South Korean Synology NAS hit by ransomware attacks; attackers demand approximately 0.037 coins BTC

Article

AI-assisted interpretation

Why it matters to readers

Risks and unknowns

Related Developments

Related concepts

Keep following

Security Center