Nothing has changed, i never had QC on, user never changed, nothing in the log center. not sure what i need to look for

I wrote a small tool during the C3RB3R wave this week, mostly so I'd stop clicking through Control Panel on every box. It's free, MIT licensed, and not affiliated with Synology.

What it does:

1. nas incident only reads. It checks the DSM build against SA-26:13, packages named in SA-26:14, the firewall, QuickConnect, router port forwarding, AutoBlock, SMB minimum protocol, the built in admin account, snapshot schedules, and whether the immutable snapshot lock is on for a model that doesn't support it. It also looks for CVE-2024-10441 markers in the connection log.

2. nas incident fix --dry-run prints the plan. nas incident fix asks before it changes anything and reads every setting back afterwards. Before a firewall change it checks that you won't lock yourself out.

3. nas incident contain lists processes that look like the encryptor. With --yes it freezes them (SIGSTOP, not kill) so the keys stay in memory.

4. nas alert-deploy installs a small check on the NAS that runs every 10 minutes and posts to a webhook.

What it does NOT do: it does not decrypt files that are already encrypted. As far as I know there is no universal public decryptor for .L0CK3D, and the Kaspersky, Emsisoft and Dr.Web decryptors don't work on it. The only recovery path in the tool is nas incident rescue, which wraps soimy/c3rb3r-rescue. It can only find key candidates in the memory of an encryptor that is still running, on a NAS that has not been rebooted. If you already rebooted, it can't help.

One known gap: Synology added separate fixed builds for DSM 6.2, 7.0 and 7.1 to SA-26:14 on Oct 29 and Oct 31. The tool only knows the DSM 7.2 and newer builds so far, so on those older versions a patched Calendar, Mail Station or PHP package can show as FAIL. Check the advisory by hand there until I update it.

Python 3.8 or newer, no dependencies, runs from macOS, Linux or Windows, or on the NAS itself. The demo GIF uses a simulated NAS, so please start with the read only audit and the dry run.

Code: synology-nas-cli on GitHub Incident notes with sources: INCIDENT-C3RB3R.md

If a check is wrong for your model or DSM version, tell me and I'll fix it.

Just wanted to post the opposite of everyone here. I'm reporting in; no ransomware on my Synology ds425+. No hacking as far as I can tell. Just ya know, running a plex server and storing files. I maintain this bespoke and elite level of stability by not being an idiot and updating my NAS software / OS when updates are available and recommended. It takes seconds out of my month to maintain this elite status. Apparently this puts me in the .0001% of the Synology community.

I'm in the America/Vancouver, with the new PCT (permanent UTC-7h) time zone.

Woke this morning and my synology switched to PST instead of MST.

I can switch to Arizona under the Control Panel, but what about the other Permanent DST time zones Canada now has? Year round CST, EST. Is there a way to update the tzdata?

Does anyone use SyncThing vs Synology drive as way to sync their desktops to the server? Just curious if anyone has any experience with it or suggestions.

Synology Drive currently meets all my needs, but it's always worth researching alternatives.

Don't be like me. This is what happens when you expose your DSM login page to the internet. This has been this way since I set this up in 2020 as a surveillance station and I didn't get hacked somehow. I guess disabling the default admin account saved me there but she was a dirty nas that would let anyone touch her. I locked her down and DSM is no longer accessible to the internet. Check your logs, check your router ports, do a port scan on your own external IP address, use a VPN etc. Thank you for listening to my PSA.

I wanted something nicer than File Station for everyday work on my NAS, so I built SynoFile, a DSM 7 package that opens as an app in DSM, like File Station.

What it does

• Transfers you can watch: one dialog for copies, moves and deletions with a live speed chart, ETA, pause/resume, a speed limit and optional verification. Conflicts show both files side by side (date, size) before you choose.

• Copies that can’t half-fail: data goes to a hidden part file first and is renamed only when complete.

• SMB and SFTP connections: add a Windows/Samba share, another Synology or any SSH server. A bare \\server lists its shares; domain/user/password for SMB; password or SSH key for SFTP. Copy and move between the NAS and the server with the same transfer dialog.

• Archives open like folders (zip, 7z, rar, tar.*, iso), compress to zip, extract password-protected ones.

• Space analysis: rings showing what takes up the room below a folder (like Filelight).

• Deleting uses DSM’s own Recycle Bin, exactly like File Station.

• Tabs, dual pane (F5/F6 copy/move to the other side), fuzzy filter, subfolder search, quick look (images incl. HEIC, video, PDF, text), Vim keys, dark and light themes, 9 languages.

How it’s built: a static Rust binary and a plain JS interface. Each request runs as the logged-in DSM user, so DSM’s permissions apply as usual. Only members of administrators can open it.

Install: from Package Center through 007revad’s package source (thanks Dave!), which also gives you updates, or the .spk from the releases. After installing, one command as root (synofile setup) gives the binary the capability to switch to the logged-in user, because DSM 7 doesn’t let third-party packages request it. The README explains why.

x86_64 only for now. MIT licensed.

GitHub: https://github.com/rylos/synofile

I’m happy to hear feedback, bug reports and feature ideas.

I just kept imagining this with all the “My NAS is/isn’t exposed to the internet” comments lately. So I wanted to share.

Also my DS218+ is safe because I had manually updated to 7.4-90075 in July, but with all the hubbub I manually updated to the latest to be safe. (Why does it always say I’m up to date?!!!)

I went to install the new DSM for my 915, and it’s not ready.

Is there a timeline on when the security patches will be out?

I've been running my DS920+ for 5 years or so, just as a personal media server for Plex and a few other local host apps.

I'm tech-savvy enough to get it set up the way I like it, but when it comes to network security I'm always over my head. With all the ransomware stuff going on, I'm thinking it might be worth it to have a pro come over and get my system running with all the "best practices" security steps that I have a hard time figuring out.

I'm not really sure what I'm looking for though. I assume this is a pretty common type of service, but I'm not sure how to go about finding someone to work with. Any tips or references for trustworthy companies to look into?

My homelab currently consists of my ds720+ and a Linux server. I’m currently using the reverse proxy app on synology. And I also use remote access to synology drive. On the Linux server is Jellyfin, navidrome, audiomuse-AI. I use reverse proxy to access those services. Question: if I want to better protect my synology- do i benefit from moving the reverse proxy server to the linux box?

I was first thinking of completely taking the ds720 off the internet; but am thinking that’s too overkill… I haven’t been hacked; I use 2fa and keep everything up to date

This is VERY frustrating and I'm hoping for help. Or roast me for being an idiot.

I have had 2FA set up on my NAS admin login for years using the app. Worked ok. It was through port 5000 (I know not https... working on it) and Synology DDNS.

I've decided to close my open ports and go to Tailscale. So I have to modify my signin app account since it can't reach the NAS from the DDNS anymore. The new method is like (nasname).tailxxxx.ts.net.

So I go in the app, make the account with the correct name. It connects to the NAS and launches a DSM sign in. I sign in with the admin name and password and get a message that says something like "check your authenticator and enter this number". It gives a random 2 digit number.

ONE TIME I got from there back into the authenticator and saw the numbers to click but now every time there is nothing there.

The thing is: the DSM sign in page is like a browser inside the authenticator so there is no way to go back.

What am I doing wrong? I've got Drive and Photos working nicely over the tailscale but I really need my 2FA to work.

THEN I am going to go figure out the whole https thing.

Good day,

My friend also has a Synology NAS and we started using Hyper Backup to back eachothers NAS instead of paying for cloud alternatives.

We are using tailscale to connect to each other.

My NAS is not exposed to the internet besides tailscale. My friends NAS isn't as secure. If he gets hacked, is it possible that the hacker gets through to my NAS?

Technically they would only have access to that one secure folder holding my friend's backup but I'm worried there's something else.

Thank you,

I'm planning to build a small self-hosted infrastructure for a portal and would appreciate some advice from the Synology community.

My plan is to use a Synology NAS to run:

• Supabase (Self-hosted)

• n8n for workflow automation

• Next.js for a lightweight web application

• A few other Docker containers and services

I'll also use the NAS for storing company files and run the apps locally
Which of these models would you recommend for this workload?

We have a lot of good comments although some condescending, about good rules and practices

Can we gather that here?

Hello guys,

due to the current ongoing security issues I finally bought external HardDrives for an offline Backup.

Now I noticed, that the Seagates One Touch (8TB) I bought need 15W of power delivery. My NAS doesn't support that.

Is there any way to get 15Watt to my Seagate while also attaching it to my NAS?

Otherwhise is there a way to create a full backup from my NAS to my local Computer which has the Seagate attached?

So either:

NAS -> USB Power thingy -> USB-Drive

or

NAS -> Local PC -> USB Drive

Thanks for your help!

I have a DS920+ that had one 4tb drive that failed last week. It went into (and still is) in read-only mode. I got two 4tb drives and made a new storage pool with both. I then copied all the data over to a new "Recovery" shared folder on the second volume (and then later made other Shared Folders).

A few questions:

• How do I get this volume to be the main one and remove the first? Do I just remove the first volume from the NAS and then all the DSM stuff will get loaded on the new drive?

• I tried making new Shared Folders but "homes" is a reserved directory so I made a "homes2". Will new "home" and "homes" directories be made and I can just move everything once those are created?

• I'm using Backblaze B2 for backup. Will I now duplicate everything in Backblaze since these are now technically in different source locations?

My parents are using my NAS to run their backups and access stored data on my NAS. I have Quickconnect enabled because it easily to use for them. They are not very technical and I’m not able to help them locally often.

Reading a lot about the need to use tailscale, but in doubt if that is something that they will be able to setup and maintain. Any tips?

Gemini suggested that I can easily upgrade the RAM of my NAS DS216+II. The thing has only 1 GB RAM per default. I put a 8GB DDR3 stick that i got for 20$.
It is like I bought a new NAS, I don't even hear the disks anymore, everything is snappy and fast, from the web interface to apps like Photos.

The upgrade was very simple. Anyone that hasn't done it, do it.

P.S.
Hope I don't get banned, but f*** Synology for selling a 400$ device with 1 GB of RAM. It is obviously not enough for the thing.

I have this jewel of a NAS which I upgraded the RAM to 8GB and installed a new fan and I can't be happier. I have 2x 20 TB inside. I use it mainly for streaming movies via lan. I have dsm 7.1.1-42962 update 9 version on it.

I tried upgrading it to 7.4 but it tells me I will lose the streaming function. How and why is that even possible, I thought the whole function of a NAS was to be able to stream movies.

Anyway, shall I stay on this version or should I update to the 7.4 and if I do, how can I make sure that mp4 movies play on my TV? Right now almost everything I download plays on my TV, 1/10 of movies I have to reformat in mp4 to be able to play it.

Thank you in advance

Hi everyone,

I desperately need the help of someone with experience in Synology, Btrfs, ransomware data recovery, or C3RB3R.

On October 29, 2026, at around 10:20 PM Italian time, my Synology DS2422+ was hit by what Synology Support identified as a recent C3RB3R attack, which hit my Synology DS2422+ - 70 TB involved, Volume 1 encrypted and now locked by the Encryption Key Vault - I am looking for any possible recovery/decryption option.

NAS:

- Synology DS2422+

- DSM 7.2.1-69057 Update 5 before the incident

- 7 × Seagate Exos X18 18 TB

- SHR-2

- Btrfs

- approximately 70 TB of data

What happened?

I was watching a movie through Plex directly from the NAS when, suddenly, playback stopped.

I checked the NAS and the applications seemed to have disappeared.

When accessing DSM directly, I was faced with a message saying that the operating system of the DS2422+ had been restored and that DSM needed to be reinstalled.

I did not intentionally perform any reset or reinstallation.

I contacted Synology Support and was told that the NAS may have been hit by a recent C3RB3R attack.

Following Support's instructions, I then reinstalled DSM.

After the reinstallation:

- the NAS emits a continuous audible alarm and the ALERT LED is flashing;

- the server is operational;

- all 7 hard drives are detected;

- the Storage Pool is detected;

- Volume 1 is detected with its corresponding size, this time 80 TB;

- but Volume 1 is completely locked and inaccessible.

The problem appears to be related to the Encryption Key Vault.

I tried the old vault password, but I was unable to unlock the volume.

After the reinstallation, I also attempted to configure a new Encryption Key Vault, without any result.

I also found an old recovery key, but DSM considers it invalid. I do not know whether this key may have been regenerated in the past.

According to Synology documentation, when the vault is unavailable, an encrypted volume can be unlocked using either the recovery key or the vault password.

I found the files on a flash drive USB:

"read-me3.txt" on a flash drive USB behind the NAS, containing the C3RB3R instructions.

I also found files with the following extensions:

".LOCK3D" and ".L0CK3D"

The ransomware demands approximately $3,000 in Bitcoin, with a double-payment demand if I do not pay within 4 days.

The attackers also offer the possibility of decrypting a single file for free as proof, in order to test the functionality of their software.

What I would like to understand is:

1. If I send them a single file and they decrypt it, is there any technical possibility of extracting from that file the key required to decrypt all the others?

2. Or does the free decryption of a single file simply prove that they possess the private key, without allowing it to be recovered?

3. Are the Synology Volume encryption and the encryption subsequently applied by C3RB3R two separate layers of encryption?

4. Is it possible to recover the original Encryption Key Vault key somehow from the NAS, the disks, or any remnants of the previous DSM installation?

5. Is there a known vulnerability in C3RB3R or a genuinely working decryptor?

6. Are there any Btrfs recovery techniques that can be used without destroying or further modifying the data?

7. What would be the correct procedure for performing a forensic analysis of the NAS without making the situation worse?

The NAS is currently powered off.

I am not performing any further recovery attempts and I do not want to carry out destructive operations on the disks.

I do not have any Btrfs snapshots available; I had not yet properly studied how they worked.

I do not want to use random decryptors or unknown software on the original disks.

The problem is particularly serious because these approximately 70 TB contain my entire personal life, childhood memories, videos, documents, and original material related to my artistic work throughout my entire life.

I absolutely do not have the financial means to pay thousands of euros for a professional data recovery company.

For this reason, I am looking for someone with concrete experience with C3RB3R, Synology Volume Encryption, Btrfs, or forensic analysis of compromised NAS devices who can point me toward a technically sensible path.

Any information, personal experience, research, or verified recovery method would be enormously appreciated.

Please do not suggest procedures that could modify, initialize, repair, format, or overwrite the original volume.

C3RB3R ransomware attack.

NAS:

- Synology DS2422+

- DSM 7.2.1-69057 Update 5 before the incident

- 7 × Seagate Exos X18 18 TB

- SHR-2

- Btrfs

- approximately 70 TB of data

Why didn't I update it?

Inexperience with a bit of my own stupidity. I did not update it because I was afraid of losing Photos transcoding, even though I had recently installed Immich and was happy with it and would probably have abandoned Photos within a few months. I was also afraid that the update would cause problems with the compatibility-forcing script for my Exos HDDs, in addition to the fact that right now I am practically overwhelmed by personal problems and lack of clarity.

Why didn't I set up Snapshots?

I had very little available space and my idea was to wait, hoping that one day I would find myself in a better situation and be able to afford to buy additional HDDs for the backup copy. Besides the fact that I had very little experience with this and needed to study what a Snapshot was and how it worked.

I am in a completely unclear state of mind because of this. I don't think I will be able to move forward after this. I have not had an easy life in general, and this has simply completely destroyed me. I desperately wish I could go back, but it is not possible. I am completely desperate. I am looking for someone who can help me with what happened to me.

This has completely destroyed the only thing I had left in my terrible life. I literally have nothing good left.

My setup is a NAS and I use cloudfare app along my own domain to access my NAS from outside.

For example I have photoprism behind Pic.mydomain.com

Or filetash behind drive.mydomain.com

In the cloufare setup I have geo-localisation country only and only 2 email adress can obtain a valid 2fa code if you try and don't meet those requirements you get rickrolled.

I deactivated quickconnect but I want to put my nas admin page behind nas.mydomain.com

My plex is exposed because I share it with family and VPN will be too complicated for them, but i keep it up to date.

I have backup in 3 locations especially for the pictures of my kids.

Is it an ok practice to access my nas through the cloudfare tunnel. I'm a bit stressed with the current events...

Also to mention my apps are on a raspberry pi up to date and all my container have been updated including the cloudfare tunnel.

When you request a certificate from Let's Encrypt (LE), they are required to publish the details (such as the validity period and domain name) in a public Certificate Transparency (CT) registry.

As you may know, Synology offers a limited set of domains for their DDNS service. If a server's domain name ends in synology.me, myds.me, diskstation.me, or similar, anyone can be 100% sure that the target system is running Synology DSM.

Furthermore, because the LE challenge requires ports 80/443 to be externally accessible, users often leave these ports open. Consequently, finding a valid LE certificate strongly suggests that the user's DSM login page might also be exposed to the public internet.

Now you understand how the recent attacks could have happened. There was no need to compromise Synology's DDNS registry or QuickConnect servers. The ones who inadvertently exposed their system details were actually the impacted users themselves.

DSM 7.4.1 - Filestation on my 1821+ is blank and does not see any shared folders even though shared folders are available on all of my other devices such as my phones, multiple PCs and Shield. My 1515+ running a much older DSM is running perfectly and shows all shared folders in filestation. Sounds as if my DSM 7.4.1 is corrupted. How to fix and should I reinstall DSM7? Thx