Synology NAS Ransomware: What MSPs Need to Know

What Happened

Synology has warned customers to update their NAS devices immediately because of a surge in Synology NAS ransomware attacks from a group called C3RB3R. BleepingComputer reports the warning, and says the attacks target network-attached storage (NAS) devices. This is not a hypothetical risk. The company is telling customers to act now.

The warning is significant because NAS devices are often left unpatched and are frequently reachable from the internet. That combination makes them a practical target for ransomware operators. If you have clients with Synology NAS units, this is a reminder to treat those devices as critical infrastructure, not as an afterthought.

Timeline

No timeline of the attacks has been published yet. BleepingComputer's report is dated November 2, 2026, but Synology has not released a detailed chronology.

Who Is Affected

Anyone running a Synology NAS device is potentially affected. The warning is aimed at Synology customers generally, and BleepingComputer describes the target as network-attached storage (NAS) devices. If your clients have Synology NAS units on their networks, including for file storage, backups, or surveillance, you should treat them as in scope.

Start by identifying which clients have Synology NAS devices. You can find this in your RMM inventory or by asking clients. Pay attention to any device that stores shared files, runs backup jobs, or is used for surveillance footage. These are the devices that will hurt most if encrypted.

Technical Details

The source does not list a CVE, specific Synology product models, or firmware versions. The attack vector is described only as ransomware attacks targeting NAS devices. Synology's warning says there has been a surge in C3RB3R ransomware attacks, and the company is telling customers to update their devices immediately. No further technical details have been published in the report we are basing this on.

At the time of writing, there is no public CVE tied to this campaign, no list of affected firmware versions, and no description of the initial access method. That may change as more information comes out. For now, the only action specified by Synology is to update immediately.

Synology NAS Ransomware: Why MSPs Should Care

NAS devices are common in SMB environments because they are cheap, easy to set up, and hold large amounts of data. That makes them a target for ransomware operators. When a NAS is encrypted, you lose files, but you also lose the ability to restore from that device if it was part of your backup chain. This is not a new lesson, but it is one that repeats every time a NAS-focused ransomware campaign gets attention.

For MSPs, the practical issue is that many clients do not think of their NAS as a server. It sits on the network, holds shared folders, and gets forgotten. A warning like this is a good reason to inventory every NAS you manage and confirm it is patched and isolated properly.

The bigger risk is when a NAS is also the backup target. If ransomware encrypts both the production files and the backup files, recovery becomes much harder. As a standing practice, keep at least one backup copy offline or in a separate environment that cannot be reached from the NAS. This is standard advice for any backup architecture, and it is worth repeating now.

What to Do This Week

Do not wait for a specific CVE or a patch advisory. The instruction from Synology is to update immediately, so treat that as your default action. The steps below are the standard hardening measures for any NAS in a client environment.

1. Update Synology NAS devices immediately. Log into DSM, go to Control Panel, and check for updates. Apply the latest firmware to every device you manage. If a device cannot be updated, isolate it or remove it from the network until you can replace it.
2. Check if any NAS devices are exposed to the internet. If a NAS has a public IP or port forwarding, remove it unless there is a specific business need. If remote access is required, set up a VPN instead of exposing the NAS directly.
3. Review backup jobs that use NAS targets. Make sure the NAS is not the only copy of critical data. Test a restore from the backup to confirm it works. If the NAS is part of the backup chain, make sure there is also an offline or cloud copy.
4. Change credentials on all NAS accounts, especially admin. Use strong unique passwords and enable multi-factor authentication where supported. Disable any default accounts that are not needed.
5. Disable unused services such as SSH, Telnet, and SMB if not needed. Limit SMB access to specific IPs or VLANs. Segment the NAS on its own network segment where possible.
6. Monitor for signs of compromise. Look for recently encrypted files with unusual extensions, new user accounts, or disabled services. Set up alerts for failed login attempts or unusual administrative activity.

What to Tell Clients

Synology has warned that ransomware operators are actively targeting NAS devices. We are checking every Synology NAS on your network and applying updates.

Please do not connect your NAS directly to the internet. If you need remote access, we will set up a VPN for you.

Also, confirm with us that the data on your NAS is included in your backup and recovery plan. If you see any files that look encrypted or renamed, do not touch them and contact us right away.

Do not pay a ransom if your data is encrypted. There is no guarantee you will get your files back, and it encourages further attacks. Your best chance is a tested backup and a clear recovery plan.

Frequently Asked Questions

Sources

• Synology warns of C3RB3R ransomware attacks targeting NAS devicesBleepingcomputer · Reported