The L0CK3D ransomware campaign, linked to the C3RB3R operation, is exploiting unpatched vulnerabilities in Synology network-attached storage devices to encrypt data and demand bitcoin payments. The attacks leverage a remote code execution flaw disclosed at Pwn2Own 2024 to compromise enterprise storage systems across Asia and beyond.
Technical Origins of the Campaign
The intrusion vector centers on CVE-2024-10441, an unauthenticated remote code execution vulnerability rated 9.8 on the CVSS scale. Researchers Pumpkin Chang and Orange Tsai of DEVCORE identified the flaw during the Pwn2Own 2024 competition. Synology patched the bug in December 2024 across DSM 6.2 and later branches, yet the vulnerability remained dormant in active exploitation until a public proof-of-concept exploit appeared on GitHub on October 25, 2026. Four days later, both Synology and security firm 360 issued advisories. Synology maintains its investigation shows the campaign exploits only the 2024 flaw, explicitly ruling out the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) patched in September 2026. 360, however, attributes the breaches to the newer September flaws, calling the operation a “1day” attack. Only one assessment can be correct regarding the entry point. Internet watchdog Shadowserver currently tracks over 380,000 Synology devices exposed to the internet, a figure that underscores the scale of the potential attack surface.
Encryption Mechanics and File Targeting
Once executed, the malware performs a recursive walk of the file system. It skips 27 system directories to maintain device operability while targeting user data and backups stored on the same appliance. The encryptor generates a unique 256-bit key for each file, utilizing the ChaCha8 algorithm for encryption and wrapping the key with RSA-2048. The malware prioritizes 187 specific file extensions for full encryption. Files outside this list undergo partial encryption to accelerate the process. Every encrypted file receives the .L0CK3D suffix.
Double-Extortion Demand Mechanics
The operators deploy a classic double-extortion model: data is encrypted, and the implicit threat of permanent loss drives payment. In every affected folder, the malware drops a read-me3.txt note containing a unique six-digit victim ID and a Tor address for negotiation. The initial demand is set at 0.036960 BTC, approximately $2,952 at current rates. A hard deadline of five days is imposed; failure to pay doubles the demand to 0.073920 BTC, roughly $5,904. Victims are directed to purchase a “C3RB3R DECRYPTOR” tool via a dark web portal. The note offers a single free file decryption as proof of capability. Korea’s KISA has acknowledged receiving multiple damage reports but has not disclosed the total victim count. Synology has not released a decryption tool or outlined a compensation plan for affected users.
Vulnerability Management and Outdated Firmware
The campaign’s effectiveness stems directly from patch latency. The exploited CVE-2024-10441 was remediated in December 2024, yet a significant population of devices remained unpatched nearly a year later. Synology’s advisory notes that many victims had not updated their DiskStation Manager software for over two years. The company has since shipped fixes across all active DSM branches, including the end-of-life 6.2 line. However, PHP 7.3 receives no patch due to its end-of-life status, leaving packages like MailStation—which requires a manual update via Package Center—permanently exposed unless migrated. The PHP2Shell vulnerabilities patched in September 2026 affect a wide suite of add-on packages including Web Station, WordPress, Joomla, MediaWiki, phpMyAdmin, Calendar, KodExplorer, and vtigerCRM, complicating the remediation landscape for administrators managing heterogeneous environments.
Mitigation Strategies for Storage Administrators
Synology advises three immediate actions: update DSM to the latest version, enable automatic updates, and block the management web interface from direct internet access. The company recommends immutable snapshots as a primary recovery mechanism, noting that backups stored on the same device are encrypted alongside primary data. For compromised systems, the guidance is to isolate the device from the network immediately or power it down if disconnection is not feasible. Administrators are instructed to preserve system logs, login records, and incident timestamps before contacting technical support. Synology rarely issues such security alerts; the previous comparable advisory was released in August 2019 following the eCh0raix ransomware wave.
Sources
- Synology Hit with L0CK3D Ransomware – How to Make Sure You Are Protected
- Synology NAS Ransomware Alert: C3RB3R Locks Files W/ .L0CK3D
- Synology warns of C3RB3R ransomware targeting outdated NAS devices
- Ransomware hits Synology NAS in Korea, demands bitcoin as damage spreads
- Synology warns of C3RB3R ransomware attacks targeting NAS devices
Photo: Korrupt (CC BY 4.0)
