Synology files locked with .L0CK3D: what do I do first?

Files renamed with .L0CK3D and a note called read-me3.txt in their folders are the marks of C3RB3R, as the security firm 360 described it on October 29, 2026. The same day Synology warned owners to update after ransomware attacks; its text does not use the name.

Gridinsoft's guide to this wave, following Synology's own response checklist, gives the first steps. Separate the drive from the network. Power it down only if you cannot cut it off, because a shutdown loses evidence.

Keep the note and a few locked files. The note's claim that paying is the only way back is the criminals' sales pitch, not a recovery assessment. Then contact Synology Support and report it.

Updating DSM closes the flaws in Synology's advisories, but it does not recover files that were already encrypted.

Moat's "Already hit?" section lists the full order and prints a one-page card for whoever helps you.

Help: grapnel.team@gmail.com · Privacy · Terms · Accessibility