Synology NAS devices in South Korea have been struck by a ransomware attack, with hackers demanding approximately 0.037 BTC to ransom the data.

According to ChosunBiz, multiple ransomware attacks targeting Synology Network-Attached Storage (NAS) devices have recently emerged in South Korea. Attackers exploited vulnerabilities in Synology’s DiskStation Manager (DSM) system to infiltrate the devices, encrypting users’ stored photos, files and other data, with affected files appended with the “.L0CK3D” suffix. The attackers demand victims pay 0.036960 BTC (approximately $2,952, or 4 million South Korean won) within 5 days to purchase a decryption tool called “C3RB3R DECRYPTOR”; ransom will double to 0.073920 BTC (about $5,904, or 8 million South Korean won) if payment is not made by the deadline. Chinese cybersecurity firm 360 analyzed that the attackers likely exploited two DSM vulnerabilities disclosed by Synology in September this year—CVE-2026-13639 and CVE-2026-13684—to breach devices, using a ransomware variant named C3RB3R to encrypt files. Both vulnerabilities allow external attackers to read or modify files without logging in, each carrying a CVSS severity score of 9.8 out of 10. Synology stated the attacks targeted devices running outdated DSM systems, advising users to immediately upgrade to the latest version. For already infected devices, it recommended disconnecting from the network or powering off, and restoring data via prior backups or snapshots. Synology has not yet released a decryption tool, recovery cost support, or compensation plan. The Korea Internet & Security Agency (KISA) has been receiving victim reports since around October 28, and is preparing to provide technical support, but has not disclosed specific victim scale or incident response details. The report notes the actual scale of losses from the attacks remains unclear, and work files and backup data on enterprise NAS devices may also be impacted.