South Korea's Synology NAS hit by ransomware attack, hackers demand about 0.037 BTC for data ransom.

October 30 - According to ChosunBiz, South Korea has recently seen multiple ransomware attacks targeting Synology Network Attached Storage (NAS) devices. Attackers exploited vulnerabilities in Synology's DiskStation Manager (DSM) system to breach devices and encrypt users' stored photos, files, and other data, with affected files being appended with the ".L0CK3D" extension. The attackers demand victims pay 0.036960 BTC, approximately $2,952 (about 4 million Korean won), within 5 days to purchase a decryption tool called "C3RB3R DECRYPTOR"; if payment is not made on time, the ransom doubles to 0.073920 BTC, approximately $5,904 (about 8 million Korean won).

Chinese security firm 360's analysis found that attackers may have exploited two DSM vulnerabilities disclosed by Synology in September this year (CVE-2026-13639 and CVE-2026-13684) to breach devices and used a ransomware variant called C3RB3R to encrypt files. Both vulnerabilities allow external attackers to read or modify files without logging in, with CVSS severity scores of 9.8 out of 10. Synology stated that the attacks target devices running older versions of the DSM system and recommended users immediately upgrade to the latest version.

For infected devices, it is recommended to disconnect from the network or power off, and restore data through previous backups or snapshots. Currently, Synology has not yet released a decryption tool, recovery cost support, or compensation plan. The Korea Internet & Security Agency (KISA) has been receiving user victim reports since around October 28 and is preparing to provide technical support, but has not yet disclosed the specific scale of victims or incident handling details. The report noted that the actual scale of losses caused by the attacks remains unclear, and work files and backup data in enterprise NAS devices may also be affected.