Ransomware against Synology NAS and a SonicWall VPN flaw: what to do

Updated 10 November 2026 · GAITS Solutions

Synology: C3RB3R ransomware against unpatched NAS

On 29 October 2026, Synology reported that attackers are exploiting a vulnerability fixed in December 2024 to attack NAS devices running old versions of DSM, its operating system. The reference advisory is Synology-SA-24:20. It is the first time since 2019 that Synology has publicly warned of an active ransomware campaign against its devices.

According to victims, the ransomware encrypts files, adds the .L0CK3D extension and leaves a ransom note. There is no known decryptor: recovery depends on having clean backups.

What to do with your Synology NAS

1. Update DSM to the latest version available for your model (Control Panel → Update & Restore) and enable automatic security updates.
2. Do not expose the admin panel to the internet. If you need remote access, use a properly configured VPN instead of opening ports.
3. Check QuickConnect and port forwarding on your router: turn off what you do not use.
4. Accounts: disable the default “admin” account, use long passwords and enable two-step verification.
5. Snapshots and an external copy: enable immutable snapshots (Snapshot Replication) if your model supports them and keep a copy outside the NAS.
6. If your NAS no longer receives updates, consider replacing it: an unpatched device connected to the internet is a permanent risk.

SonicWall: exploited flaw in the SSL VPN

On 6 November 2026, the US Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-19868 to its catalogue of exploited vulnerabilities. It affects the SSL VPN service of SonicWall firewalls running SonicOS. The flaw only applies if VPN login uses SAML: an attacker with valid credentials for another authentication method can bypass the SAML controls and, with them, two-step verification.

SonicWall has already released the fix (advisory SNWLID-2026-0014) and there is no workaround that replaces updating.

What to do if you use SonicWall

1. Check whether your SSL VPN uses SAML authentication.
2. Update SonicOS to the fixed version indicated by SonicWall for your device.
3. Review VPN logs from recent weeks: logins from unusual countries or at odd hours.
4. Change passwords for accounts that may have been exposed and remove users who no longer work at the company.

The underlying lesson

In both cases, attacks exploit unpatched devices: the Synology flaw had been fixed for almost two years. Devices that provide access from the internet (NAS, VPNs, firewalls, web servers) must be updated within days. If nobody looks after this in your company, our IT maintenance includes it, together with cybersecurity monitoring and backups. Read also about PHP2Shell, the other critical advisory from October.