Synology NAS Devices Hit by L0CK3D Ransomware Campaign

HKEPC reports that a large number of Synology NAS devices have been compromised by a ransomware campaign that encrypts files with the .L0CK3D or .L0CK3D. extension and drops a ransom note named read-me3.txt. The note reportedly contains the text C3RB3R INSTRUCTIONS. According to the report, affected users found encrypted files in File Station, including shared folders, enterprise development documents, database images, and routine backup files. Synology has reportedly confirmed the L0CK3D ransomware attack and strongly urged all users to update DSM immediately. The report says the infection is not primarily spreading from infected Windows machines through SMB shares. Instead, security responders traced the attacks to Synology NAS devices exposed to the public Internet. The attackers are reported to have used two remote code execution vulnerabilities with a CVSS score of 10.0 to launch automated attacks. One reported vector involves Docker containers running on the NAS. The source says some organizations run GitLab, Confluence, or other web services in Container Manager and map ports to external networks. It cites recent unauthorized RCE vulnerabilities in GitLab, including CVE-2026-110264 and CVE-2026-97229, and says attackers can use high-privilege container mounts or host-escape flaws to write a malicious script into Linux crond scheduled tasks. This would allow the payload to remain dormant until the scheduled task triggers it.

A second reported vector is a native Synology package vulnerability. The source says Synology issued security advisory Synology-SA-26:14, confirming that PHP core RCE vulnerabilities CVE-2026-109618 and CVE-2026-109619, referred to as PHP2Shell, affect MailStation, Synology Calendar, and other native packages. According to the report, an attacker does not need an account or password to reach the DSM layer through an exposed port and can implant the encryption payload.

The ransomware is reported to start from the Linux root directory and scan all mounted storage, including /volume1 and /volume2. Local backups on the same machine, including Hyper Backup directories without multi-version locking or off-site isolation, are said to be treated as ordinary files and encrypted. The source describes the encryption as using RSA-4096 combined with AES or ChaCha20, and says that no general free decryption tool is available.

HKEPC advises users whose NAS has not yet been compromised to disconnect the network cable immediately or cut external and internal SMB access from the router. If the management interface is still reachable, it recommends stopping all containers in Container Manager, pausing Hyper Backup and Cloud Sync, and avoiding deletion, storage reorganization, or file cleanup. For infected systems, the report says users should preserve the ransom note, SSH logs, and container logs, and should not reinstall the system or initialize drives before forensic analysis. The source says these files are important for determining the encryption process, tracing the vulnerability, and reporting the incident to Synology.