# Ransomware Attacks on Synology NAS Users in South Korea Demand Bitcoin

By Simon Yoon

Canonical URL: https://www.tokenpost.com/news/technology/44501
Published: 2026-10-30T10:04:11.000Z
Updated: 2026-10-30T10:04:11.000Z
Section: Technology

> The initial demand is 0.036960 BTC for a decryption tool and doubles after five days. Synology urged users to update older DSM versions.

Attacks targeting Synology NAS users in South Korea are demanding Bitcoin (BTC) to decrypt files, with the requested amount set to double after five days.

Attackers are using C3RB3R ransomware to encrypt files including photos and documents. The initial demand is 0.036960 BTC for a decryption tool. If victims miss the five-day deadline, the demand rises to 0.073920 BTC.

The Korea Internet & Security Agency (KISA) has received reports from multiple victims. Synology confirmed Thursday, Oct. 29, that attackers were exploiting previously patched vulnerabilities in older DSM versions. The company urged users to update.

The attacks involve vulnerabilities CVE-2026-13639 and CVE-2026-13684. Each vulnerability has a CVSS severity score of 9.8.