Ransomware hits Synology NAS in Korea, demands bitcoin as damage spreads - Chosunbiz
A ransomware attack targeting security vulnerabilities in the network-attached storage (NAS) of Synology, a Taiwan data storage corporations, has been spreading in Korea, as confirmed on the 30th. The Korea Internet & Security Agency (KISA), a private-sector incident response body for cyber breaches, also received multiple damage reports from domestic users. The attacker was found to encrypt photos and documents so they cannot be opened, then demand 0.036960 bitcoin (BTC) for recovery. To use the files again, the demand is about $2,952 (about 4 million won), with a threat to double the amount if the deadline is missed.
Synology did not issue a separate warning even after damage mounted overseas and security firms published attack analyses, and belatedly disclosed the attack on its official website and recommended a security update. It only guided users to restore locked files from existing backups and did not provide a decryption tool or a compensation plan.
NAS is a device connected to the internet or an internal network to store and share photos, videos, and work materials. It is used not only as a personal cloud but also as a file-sharing and backup server for corporations. What the attacker targeted was a security vulnerability in Synology's own operating system, DiskStation Manager (DSM), which handles device operation and file management. If even the backups are encrypted, the means to restore the original data may be lost.
In Korea, starting on the 28th, a series of cases occurred in which files stored on Synology NAS were encrypted and would not open. The devices were infected with malware that searches for stored files, excluding some necessary system folders, and encrypts them. The file names ended with the extension ".L0CK3D." Because the attack encrypts the file contents themselves, changing the name or extension does not allow photos or documents to open normally.
The attacker left a threat note in folders containing encrypted files. Users were told to buy a decryption program called "C3RB3R DECRYPTOR" to get their files back. Payment was limited to bitcoin, and the deadline was set at five days. The note threatened to raise the demand to 0.073920 BTC, or about $5,904 (about 8 million won), if the deadline was missed.
Similar damage emerged overseas this month. China security firm 360 said the previous day that several requests related to ransomware had been received by its service and released the results of analyzing malware obtained from affected devices.
360 analyzed that the attacker broke in by exploiting two vulnerabilities (CVE-2026-13639 and CVE-2026-13684) in Synology's DSM disclosed in September, then encrypted files with "C3RB3R," a variant of the existing ransomware Cerber. The flaws allow external attackers to read or modify files without logging in, and each received a severity score of 9.8 out of 10 on the Common Vulnerability Scoring System (CVSS).
Synology said, "We have confirmed a ransomware attack that targets devices running older versions of DSM by exploiting vulnerabilities for which security patches were released in December 2024," and added, "We strongly urge all customers using vulnerable DSM versions to immediately update to the latest version to protect their systems."
Synology also explained that using the latest DSM provides protection from the vulnerabilities. Infected devices should be isolated from the network, or powered off if disconnection is not possible. It also advised organizing the incident time, system information, and login records and contacting the technical support team. For data recovery, it said to "restore using backup data." In other words, revert using pre-saved backups or "snapshots" that preserve a file state at a specific point in time.
However, Synology did not provide a separate position on whether it has or is developing a decryption tool, on recovery cost support, or on compensation plans. It also did not disclose the scale of damage at home and abroad, the primary affected models, or when it first became aware.
Reports of domestic damage began to be filed with KISA around the 28th. The KISA technical support team is said to plan to review the reports and then contact the filers to guide them on response measures.
In response to ChosunBiz's questions about the current response status, the initial attack time, the cause, the scale of damage, and follow-up measures, KISA said, "It is difficult to provide specific answers regarding the circumstances and causes of incidents, the scale of damage, and the response status related to particular corporations and services."
Synology is a corporations that has deployed more than 14 million systems across regions worldwide. It is also rapidly growing its business in Korea. Over the past three years, sales in the Korea market recorded average double-digit growth, and annual revenue in the business-to-business (B2B) institutional sector increased by more than 50%, it said.
In Korea, SBS adopted Synology systems as a video storage and editing file server; SK Shipping uses them for file sharing and remote backup; and the Korean Air Lines aerospace division uses them for file sharing and collaboration. Synology on Sept. 18 released an update to fix the system's security vulnerabilities. A security industry expert said, "When equipment for corporations is attacked, work materials and backups can be damaged and it can snowball into business disruption, so swift action is needed."
