Synology users in South Korea face ransomware attacks exploiting two software flaws, putting files on devices running older versions of the company's DSM software at risk of encryption and ransom demands. The C3RB3R ransomware encrypts files, including photos and documents, and its operators seek Bitcoin payments for a decryption tool.
The initial demand is 0.036960 Bitcoin (BTC). After five days, attackers raise it to 0.073920 BTC, exactly double the initial amount.
On Thursday, Oct. 29, Synology confirmed that attackers had used two vulnerabilities already fixed in previous DSM releases. The company urged customers using older versions to update. The vulnerabilities are CVE-2026-13639 and CVE-2026-13684; each has a CVSS score of 9.8.
South Korea's Korea Internet & Security Agency (KISA) said multiple victims had filed reports.
