Network Security · November 2, 2026 · ComputerKing Team
Disconnect now: Synology confirms ransomware on outdated DSM; Hong Kong reports files encrypted to .L0CK3D
On 29 Oct 2026 Synology confirmed ransomware against outdated DSM and pointed to Synology-SA-24:20 / CVE-2024-10441. Hong Kong media report .L0CK3D, read-me3.txt and C3RB3R. Isolate, update, and check public exposure tonight.
CTA: {{CTA}} (in-store / WhatsApp DSM check; no promise of decryption)
Do this tonight (summary)
1. If you suspect a hit → pull the network cables (or cut WAN / SMB at the router).
2. If you are not hit → open Control Panel → Update & Restore and move to the latest build on your branch; turn off router port forwarding / UPnP (especially 5000, 5001, 80, 443).
3. Keep the ransom note and logs; do not rush to initialise the disks.
4. Talk about restore only if you have an offline or off-site backup. Synology cannot decrypt customer data for you.
What happened
On 29 October 2026, Synology said it had identified threat actors targeting devices still running outdated DSM, using a vulnerability patched in December 2024 to encrypt data and demand a ransom. It urged users to update DSM immediately and turn on automatic updates. The notice points to security advisory Synology-SA-24:20.
The same day, Hong Kong outlet HKEPC reported that many NAS users were seeing shared files, database images and even local backups renamed to .L0CK3D / .L0CK3D. in File Station, with read-me3.txt in folders (containing the words "C3RB3R INSTRUCTIONS"), and told people to isolate first. The next day RSM Hong Kong issued a Critical alert: internet-exposed Synology NAS units are the high-risk group, and it names the family Cerber / C3RB3R.
Editor's note: Synology's short news post does not name the .L0CK3D extension or a ransomware brand. Those indicators come from Hong Kong media and incident response. The official attribution is SA-24:20.
What the vendor said, and what it did not say
| Detail | |
|---|---|
| Said | outdated DSM; a flaw patched in Dec 2024; update now and enable auto-update; points to SA-24:20 |
| Did not say | victim counts, a specific ransomware brand, or the string .L0CK3D |
Critical RCE CVE-2024-10441 (CVSS 9.8) is part of SA-24:20: improper encoding / escaping in the system plugin daemon can lead to remote code execution. It affects BSM before 1.1-65374 and DSM builds before the versions listed in the advisory. The same advisory also covers CVE-2024-50629 and CVE-2024-10445. The short news post does not say which of the three CVEs was weaponised. The accurate line is: official attribution points to SA-24:20; the Critical RCE is CVE-2024-10441.
SA-24:20 minimum fixed builds (copied from the advisory; this is the ransomware attribution table)
| Product | Fixed |
|---|---|
| DSM 7.2.2 | 7.2.2-72806-1 or later |
| DSM 7.2.1 | 7.2.1-69057-6 or later |
| DSM 7.2 | 7.2-64570-4 or later |
| DSM 7.1 | 7.1.1-42962-7 or later |
| DSM 6.2 | 6.2.4-25556-8 or later |
In practice, move to the current latest build on that branch. Do not stop at "just past the minimum".
Public timeline
- 2024-11 Synology-SA-24:20 (Pwn2Own 2024) published; fixes landed across branches (the DSM 6.2 fix is marked December 2024).
- 2025-03 CVE-2024-10441 details published.
- 2026-09-18 Synology-SA-26:13, a Critical DSM advisory (including CVE-2026-13639 / 13684 and others) — kept separate from the official ransomware attribution.
- 2026-10-22 Synology-SA-26:14 PHP2Shell.
- 2026-10-29 Two Synology news posts (ransomware attributed to the Dec 2024 fix / SA-24:20; a separate push for PHP2Shell package updates) plus the HKEPC .L0CK3D report.
- 2026-10-30 RSM Hong Kong Critical alert.
Vector dispute (sidebar — required)
| Claim | What it is |
|---|---|
| Vendor: ransomware ↔ SA-24:20 / a flaw patched in Dec 2024 | Official |
| Same day: PHP2Shell package / PHP updates (SA-26:14) | Parallel hygiene, not the root cause in the ransomware sentence |
| HKEPC: Docker / GitLab + PHP2Shell | Media; the GitLab CVE was not independently verified here |
| Secondary sources: SA-26:13 as the main entry point | Conflicts with the official attribution → sidebar only |
Do not write SA-26:13 as "Synology confirmed this wave of ransomware is using that". You can write: a Critical DSM update already existed in September, and every branch should be on its current latest build.
Why the on-box backup dies with the NAS
HKEPC reported that the encryption process walks mounted volumes from the root. A Hyper Backup folder that was never isolated off the box is just another set of files and gets locked with them. RSM also warns that attackers can delete or encrypt local backups, which leaves a small business with no way back. RAID is not a backup. Hyper Backup on the same NAS is not an off-site backup.
Hong Kong angle
A common local pattern is a home-grade NAS with port forwarding so someone can view photos or take orders from work. That is the high-exposure group. HKEPC's Instagram line "don't ask — disconnect and stay safe" spread the warning. RSM is aimed at branches and SMEs that keep shares and backups on the same NAS. Recovery and privacy notification here are general prompts, not legal advice. HKCERT is the place to contact when that fits the situation.
Where to go next
- RecoveryData: 10 steps after a hit (isolate → preserve evidence → assess backups)
- ServersKing: hardening a DSM or container that faces the public internet
- Computerhome: 5 steps for a home or small shop
- SoftKing: backup design (HOLD — do not push yet)
- On this site: Synology NAS recovery, ransomware recovery
CTA: {{CTA}}
Primary sources
1. Synology ransomware news, 29 Oct 2026
2. Synology-SA-24:20 (CVE-2024-10441)
3. Synology PHP2Shell news / SA-26:14
4. HKEPC 27124 / 27125