# C3RB3R Ransomware Hits Synology NAS Devices Running Outdated DSM

- URL: https://usa-24.com/synology-nas-ransomware-c3rb3r-dsm-update/
- Publisher: USA 24
- Section: Cybersecurity
- Published: 2026-10-31T15:13:32.652Z
- Updated: 2026-10-31T15:13:32.658Z
- Topics: Ransomware, Synology, NAS Security, DSM Updates, Data Backup, Small Business Security

> C3RB3R ransomware is encrypting files on internet-exposed Synology NAS devices, and Synology and the security firm 360 disagree on the flaw that lets it in.

## Key takeaways

- The C3RB3R ransomware renames encrypted files with a .L0CK3D extension and places a ransom note called read-me3.txt in each folder.
- Synology ties the attacks to a December 2024 patch under advisory SA-24:20, while 360 names CVE-2026-13639 and CVE-2026-13684, which Synology fixed on September 18.
- The minimum fixed builds cited in coverage are DSM 7.4-90075, 7.3.2-86009-4, 7.2.2-72806-9 and 7.2.1-69057-12, or later in each branch.
- As of October 30, no free decryptor had been released, and Synology does not offer one.
- Synology advises against exposing DSM directly to the internet and recommends a VPN for remote file access.

Synology NAS ransomware is now encrypting files on home and small-office storage boxes that run outdated DiskStation Manager (DSM) software. The strain, called C3RB3R, locks shared folders, business documents and backups. The device maker and the Chinese security firm 360 disagree about which software flaw lets the attackers in.

## How Synology NAS ransomware C3RB3R encrypts files

Both sides went public on October 29, 2026. According to [CyberExperts' write-up](https://cyberexperts.com/2026-10-30-synology-dsm-c3rb3r-ransomware/), 360's anti-ransomware team had handled repeated attacks on Synology NAS devices by C3RB3R, which it describes as a variant of Cerber, a long-running ransomware family. Synology confirmed the attacks in its own statement that day and told users on older DSM releases to update right away and turn on automatic updates, as [reported by Pasquale Pillitteri](https://pasqualepillitteri.it/en/news/28669/synology-nas-c3rb3r-ransomware-l0ck3d) and [ipsip](https://www.ipsip.vn/en/post/c3rb3r-ransomware-synology-nas).

The campaign is aimed at US home offices and small businesses that keep files and backups on a NAS. Those are the setups where a single box often holds everything.

The attacks reportedly began in early October 2026, according to [TrebSec](https://www.trebsec.com/briefs/2026-10-29-synology-c3rb3r-ransomware.html). Encrypted files get renamed with a .L0CK3D extension, and each folder receives a ransom note called read-me3.txt, as [IT-Connect reports](https://www.it-connect.tech/c3rb3r-ransomware-is-hitting-synology-nas-devices-how-to-protect-yours/).

Reported victim data includes shared folders, business development documents, database images and routine backup files, according to [Guru3D](https://www.guru3d.com/story/synology-nas-devices-hit-by-l0ck3d-ransomware-campaign/). For a small office, the backup files may be the most painful loss, because they are usually the copies people would restore from.

Researchers say the attacks target devices exposed to the internet and need no account or password to reach the DSM layer. That detail undercuts a common assumption. A strong admin password does not help much if the attacker never has to log in.

One report puts the ransom demand at about $2,952 in bitcoin, doubling after five days. That figure comes from a single source and has not been verified.

## Which DSM builds include the fix

The coverage cites the following minimum fixed builds. Each one is the minimum for its branch, and any later build in that branch counts as fixed. The builds appear in [TrebSec's brief](https://www.trebsec.com/briefs/2026-10-29-synology-c3rb3r-ransomware.html) and [IT-Connect's guide](https://www.it-connect.tech/c3rb3r-ransomware-is-hitting-synology-nas-devices-how-to-protect-yours/).

| DSM branch | Minimum fixed build |
|---|---|
| DSM 7.4 | 7.4-90075 |
| DSM 7.3.2 | 7.3.2-86009-4 |
| DSM 7.2.2 | 7.2.2-72806-9 |
| DSM 7.2.1 | 7.2.1-69057-12 |

According to 360, Synology's fixes shipped on September 18, 2026. The two critical DSM flaws it names, CVE-2026-13639 and CVE-2026-13684, were addressed in Synology advisory SA-26:13, as [NASCompares notes](https://nascompares.com/news/synology-lock3d-c3rb3r-ransomware-attack-everything-you-need-to-know/amp/).

One responder, Solar, reported a victim already running DSM 7.4.1 and suspects a zero-day, according to [Pillitteri's report](https://pasqualepillitteri.it/en/news/28669/synology-nas-c3rb3r-ransomware-l0ck3d). Nobody has published proof. Treat that as an open lead, not a finding.

## Why Synology and 360 disagree on the entry point

Synology ties the attacks to a vulnerability it patched in December 2024, referenced as advisory SA-24:20, according to [ipsip](https://www.ipsip.vn/en/post/c3rb3r-ransomware-synology-nas). The security firm 360 points instead to the September 2026 flaws. Synology has not published a victim count or a full entry-route analysis for every incident.

The answer changes how many people are exposed. If the December 2024 flaw is the way in, any NAS that never installed that patch has been open for nearly two years. If the September 2026 flaws are the cause, the fix has been public for about six weeks, and the owners at greatest risk are the ones who have not installed it yet. Both scenarios point to the same action: update and close the internet path.

Researchers also cite other possible routes. Those include Docker-container remote code execution and a Synology package flaw linked to PHP2Shell, according to [Guru3D](https://www.guru3d.com/story/synology-nas-devices-hit-by-l0ck3d-ransomware-campaign/). Synology's advisory SA-26:14 reportedly covers PHP core flaws CVE-2026-109618 and CVE-2026-109619 in native packages. CISA added those two PHP CVEs to its [Known Exploited Vulnerabilities catalog](https://www.cisa.gov/news-events/alerts/2026/10/26/cisa-adds-two-known-exploited-vulnerabilities-catalog) on October 26.

For another recent catalog addition, see our coverage of the [Ivanti Connect Secure flaws that CISA added to KEV](https://usa-24.com/ivanti-connect-secure-vulnerability-cisa-kev/). For a Linux example, see [the Fragnesia listing ahead of its deadline](https://usa-24.com/fragnesia-cve-2026-46300-linux-patch/).

Some reporting notes that the disagreement is not proof of a new zero-day, an attack on fully updated DSM or a vendor compromise, according to [Gridinsoft](https://blog.gridinsoft.com/synology-c3rb3r-ransomware-nas-backups/). That caution cuts both ways. Nobody has proved a zero-day, but nobody has ruled one out either.

Synology hardware has been targeted before. In 2014 a strain called Synolocker hit its NAS boxes, according to [an archived copy of The Register's coverage](https://forums.theregister.com/forum/all/2014/08/05/synologys_synolocker_crisis_its_as_bad_as_you_think/).

## How to tell if your Synology NAS is infected

Two markers have been reported so far. Search your shared folders for files ending in .L0CK3D, and look for a ransom note named read-me3.txt in each folder. Some reports write the extension with a letter O, as .LOCK3D, so search for both spellings. Coverage of that spelling appears in [Noransom's recovery guide](https://noransom.net/en/solutions/synology-nas-encrypted/) and [IT-Connect](https://www.it-connect.tech/c3rb3r-ransomware-is-hitting-synology-nas-devices-how-to-protect-yours/).

No encrypted files does not mean the device is safe. An exposed, outdated DSM is a risk on its own, and it can be a foothold before any encryption starts.

## What to do now if your NAS is exposed

Work through these steps in order.

1. Check your DSM version against the table above. If it sits below the fixed build for its branch, install the update and turn on automatic updates.
2. Remove direct internet exposure of DSM. Synology's hardening guidance, as summarized by [Gridinsoft](https://blog.gridinsoft.com/synology-c3rb3r-ransomware-nas-backups/), advises against exposing DSM directly to the internet and recommends a VPN for remote file access.
3. Confirm you have a current backup stored offline or off the device. No free decryptor had been released as of October 30, and Synology does not offer one, so a clean backup is the most reliable recovery path.
4. If files are already encrypted, disconnect the NAS from the network. Before any reset, preserve the ransom note, sample encrypted files, the DSM version, the package list and the logs. A Windows antivirus scan cannot repair DSM or decrypt the files, so do not count on one.

## What comes next for Synology NAS owners

Several questions remain open. Synology has not said whether it will publish a new advisory or extend fixes to older DSM branches. The entry point is still disputed, and the victim count and ransom figure are unverified. Coverage so far is concentrated in Chinese and English-language outlets, so the campaign's reach elsewhere is unclear.

Three signals matter most. A new Synology advisory that names a single entry point would settle the dispute. A confirmed zero-day would change the risk picture, though not the core advice. A free decryptor would change recovery options for victims without a clean backup. Until one of those arrives, the job is the same as it was before this story: patch, pull DSM off the open internet and test a restore.

## Frequently asked questions

### Is my Synology NAS infected by C3RB3R ransomware?

Look for files ending in .L0CK3D and a ransom note called read-me3.txt in shared folders. Some reports spell the extension .LOCK3D with a letter O, so search for both. If you find either, disconnect the device from the network and preserve the evidence before any reset.

### Which DSM versions include the fix?

Coverage cites minimum fixed builds of DSM 7.4-90075, 7.3.2-86009-4, 7.2.2-72806-9 and 7.2.1-69057-12, or later in each branch. Synology's fixes shipped September 18, 2026, according to 360. Install the update and turn on automatic updates.

### Can I decrypt my files for free?

As of October 30, no free decryptor had been released, and Synology does not offer one. Restoring from an offline or off-device backup is the most reliable path right now. Paying a ransom has no guarantee of recovery, and no source in the reporting says otherwise.

### Should I keep DSM reachable from the internet?

No. Synology's hardening guidance advises against exposing DSM directly to the internet. It recommends a VPN for remote file access instead.

### Is this attack using a zero-day flaw?

That is unresolved. Synology points to a December 2024 patch, while 360 names flaws fixed in September 2026. One responder suspects a zero-day but has published no proof.

## Sources

1. [Synology NAS Devices Hit by L0CK3D Ransomware Campaign](https://www.guru3d.com/story/synology-nas-devices-hit-by-l0ck3d-ransomware-campaign/)
2. [Synology NAS hit by C3RB3R ransomware, files locked with .L0CK3D](https://pasqualepillitteri.it/en/news/28669/synology-nas-c3rb3r-ransomware-l0ck3d)
3. [CVE-2026-13639: C3RB3R Ransomware Hits Synology NAS, Update DSM](https://cyberexperts.com/2026-10-30-synology-dsm-c3rb3r-ransomware/)
4. [C3RB3R Ransomware Is Encrypting Synology NAS Devices That Missed a September Patch](https://www.trebsec.com/briefs/2026-10-29-synology-c3rb3r-ransomware.html)
5. [C3RB3R Ransomware Is Hitting Synology NAS Devices: How to Protect Yours](https://www.it-connect.tech/c3rb3r-ransomware-is-hitting-synology-nas-devices-how-to-protect-yours/)
6. [Synology NAS Hit by Lock3d Ransomware: Recovery Options](https://noransom.net/en/solutions/synology-nas-encrypted/)
7. [Synology C3RB3R Ransomware: Locked NAS Files and Patch Advice](https://blog.gridinsoft.com/synology-c3rb3r-ransomware-nas-backups/)
8. [Synology LOCK3D / C3RB3R Ransomware Attack](https://nascompares.com/news/synology-lock3d-c3rb3r-ransomware-attack-everything-you-need-to-know/amp/)
9. [C3RB3R Ransomware targets synology NAS: Signs, patches and recovery](https://www.ipsip.vn/en/post/c3rb3r-ransomware-synology-nas)
10. [CISA Adds Two Known Exploited Vulnerabilities to Catalog (Oct 26, 2026)](https://www.cisa.gov/news-events/alerts/2026/10/26/cisa-adds-two-known-exploited-vulnerabilities-catalog)
11. [Ransomware attack hits Synology's NAS boxen (The Register, 2014, archived forum copy)](https://forums.theregister.com/forum/all/2014/08/05/synologys_synolocker_crisis_its_as_bad_as_you_think/)