# Synology Ransomware: C3RB3R Hits NAS Devices Running Outdated DSM

- URL: https://usa-24.com/synology-ransomware-c3rb3r-dsm-update/
- Publisher: USA 24
- Section: Cybersecurity
- Published: 2026-11-07T09:49:39.425Z
- Updated: 2026-11-07T09:49:39.437Z
- Topics: Ransomware, Synology, NAS Security, Patch Management, Home Networking

> C3RB3R is encrypting Synology NAS files on DSM builds that missed fixes from September 2026 and December 2024. Here is how to check your device and protect its backups.

## Key takeaways

- Synology warned on October 29, 2026 that attackers were encrypting data on devices running outdated DSM versions and demanding ransom.
- Encrypted files receive a .L0CK3D extension, and a ransom note named read-me3.txt appears in each folder.
- Fixed DSM builds under Synology's SA-26:13 advisory include 7.4-90075, 7.3.2-86009-4, 7.2.2-72806-9 and 7.2.1-69057-12.
- Qihoo 360 says the attacks use CVE-2026-13639 and CVE-2026-13684, while a Synology spokesperson pointed to the 2024 advisory and named no CVE.
- Synology has published no decryptor or indicators of compromise, so offline backups remain the most reliable recovery path.

Attackers are encrypting files on Synology network-attached storage devices that never received current DiskStation Manager (DSM) updates, and the campaign is still active nine days after Synology's warning. The ransomware is called C3RB3R. According to [CyberExperts](https://cyberexperts.com/2026-10-30-synology-dsm-c3rb3r-ransomware/), Qihoo 360's anti-ransomware team saw repeated attacks on Synology NAS devices, and the activity has been running since early October. For US home users and small offices that keep backups on these boxes, the damage can land on the very copies meant to save them.

On October 29, 2026, Synology published a [security alert](https://www.csirtcan.org/en/blog/synology-warns-ransomware-attacks-targeting-nas-devices-running-outdated-dsm-versions) warning that attackers were encrypting data on devices running outdated DSM versions and demanding ransom. In a statement quoted by [BleepingComputer](https://www.bleepingcomputer.com/news/security/synology-warns-customers-of-ongoing-c3rb3r-ransomware-attacks/), the company said: "Synology strongly urges all users running vulnerable versions to update DSM immediately to protect their systems."

The attack path is a patch gap, not a new zero-day. The fixes already exist, some for months and one set for almost two years. For each owner, the real question is whether the device received them.

## What the Synology ransomware attack does to files

C3RB3R is a variant of the Cerber ransomware family, according to [CUHK IT Services](https://www.itsc.cuhk.edu.hk/all-it/information-security/information-security-alerts/ransomware-c3rb3r-ransomware-targeting-synology-nas-devices/). Encrypted files receive a ".L0CK3D" extension, and a ransom note named "read-me3.txt" appears in each folder, as [The Hacker News](https://thehackernews.com/2026/11/synology-nas-devices-targeted-in.html) reported. These are the most concrete markers in public reporting so far.

Synology has not published indicators of compromise or a decryptor, so a clean-looking folder does not prove a device is safe. The Hacker News covered the campaign on November 3, and a November 7 [DEV Community analysis](https://dev.to/shaam_ai/synology-c3rb3r-ransomware-sa-2613-vs-sa-2420-fixes-11dj) compared the SA-26:13 and SA-24:20 fixes. Coverage is still moving because the campaign is still live.

## Which DSM versions are at risk

It is still unclear which flaw attackers used. Synology's own warning points to its older SA-24:20 advisory. When BleepingComputer asked which flaw was involved, a Synology spokesperson pointed back to that 2024 advisory and did not name a CVE.

360 offers a different account. According to [CyberExperts](https://cyberexperts.com/2026-10-30-synology-dsm-c3rb3r-ransomware/), the attacks use two DSM flaws, CVE-2026-13639 and CVE-2026-13684, which Synology fixed on September 18, 2026 in advisory SA-26:13. 360 rates each at CVSS 9.8. A less authoritative [Rescana analysis](https://www.rescana.com/post/synology-dsm-c3rb3r-ransomware-sa-24-20-prepare-now) names CVE-2024-10441 as Synology's diagnosis, which conflicts with the company's statement that it named no CVE. That claim remains unconfirmed.

The two advisories list different builds, and the gaps matter. Blank cells mean the reporting did not list a fixed build for that branch under that advisory, not that the branch is safe.

| DSM branch | Fixed build in SA-26:13 (Sept. 18, 2026) | Minimum fixed build in SA-24:20 (Dec. 2024) |
|---|---|---|
| DSM 7.4 | 7.4-90075 | Not listed |
| DSM 7.3.2 | 7.3.2-86009-4 | Not listed |
| DSM 7.2.2 | 7.2.2-72806-9 | 7.2.2-72806-1 |
| DSM 7.2.1 | 7.2.1-69057-12 | 7.2.1-69057-6 |
| DSM 7.2 | Not listed | 7.2-64570-4 |
| DSM 7.1.1 | Not listed | 7.1.1-42962-7 |
| DSM 6.2.4 | Not listed | 6.2.4-25556-8 |

Synology has not said whether DSM 7.2, 7.1 and 6.2 devices are affected by SA-26:13 or simply unsupported for it. One source describes DSM 7.0 and 7.1 as end-of-life with no patch, according to [DEV Community](https://dev.to/etairos/c3rb3r-ransomware-hits-unpatched-synology-nas-devices-through-flaws-fixed-almost-two-years-ago-18d1). Owners on those branches may need a major-version upgrade rather than a point update.

One analysis cites Shadowserver tracking more than 380,000 Synology NAS devices exposed to the internet. That figure shows how many boxes could be reached, not how many have been encrypted. No source documents an encrypted-device count.

Synology has also released PHP updates for separate PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619, according to [Technine](https://technine.io/en/blog/synology-nas-ransomware-outdated-dsm). Those are a different threat, but they point to the same lesson about internet-facing software. USA 24 has covered [active attacks on the PHP2Shell flaws](https://usa-24.com/php2shell-exploits-palo-alto-firewalls/) aimed at firewall interfaces.

## Steps to take on a Synology NAS today

- Check your DSM version. Open DSM Control Panel, note the installed build, and compare it with the fixed builds for your branch in the table above.
- Install the fixed build. Go to DSM Control Panel > Update and Restore and apply the update for your branch. If your device runs DSM 7.0, 7.1 or 6.2, a point update may not exist, so check whether your hardware supports a newer major version.
- Turn on automatic updates. This closes the gap for owners who would otherwise forget the device exists.
- Cut off the management interface. Block DSM management from the internet and remove any port forwards that expose it.
- Look for the reported markers. Search for files with the .L0CK3D extension and for read-me3.txt. Because Synology has not published indicators of compromise, a clean search does not prove the device is clean.
- Protect your backups. Keep at least one copy offline or stored separately. The update blocks new infections but does not recover files that are already encrypted.
- Hold off on any payment. Synology has not released a decryptor, so check for one before paying anything.

## Why the patch gap is the bigger lesson

NAS boxes often sit in closets, run unattended and rarely get touched after setup. Attackers did not need a novel exploit here. They needed devices that had been left behind. The SA-26:13 fixes arrived roughly six weeks before Synology's October 29 warning, which gave anyone watching advisories a short head start and everyone else very little.

The winners are obvious. Home users and small businesses that treated a NAS as a set-and-forget file server or backup target carry the cost. Synology also faces a credibility question. Its warning and its spokesperson pointed to a 2024 advisory without naming a CVE, which makes it harder for administrators to match the alert to a specific patch.

The pattern is not unique to Synology. USA 24 told readers to check their SSLVPN appliances after [SonicWall CVE-2026-19868](https://usa-24.com/sonicwall-cve-2026-19868-sslvpn-exploit/) came under active attack. Devices with exposed management interfaces keep appearing in attack reports, and the same habit of delayed patching keeps paying off for attackers.

## What to watch next

- Which CVE Synology says was exploited, and whether the company publishes indicators of compromise.
- Whether C3RB3R entered through the 2024 flaw, the 2026 flaws or both. 360 and Synology disagree on the entry point, according to [Techaeris](https://techaeris.com/2026/10/31/synology-nas-ransomware-alert-c3rb3r/).
- How many devices have actually been encrypted. Only exposure counts are documented so far.
- Whether DSM 7.2, 7.1 and 6.2 devices receive fixes, or whether those branches are simply left behind.
- Who runs C3RB3R, and whether a decryptor appears.

The next useful signal is Synology's own advisory. If the company names the exploited CVE and publishes indicators, administrators can verify exposure far faster than they can by guessing from version strings. Until then, treat any internet-reachable NAS on an old DSM branch as in scope, and check your backups before you check anything else.

## Frequently asked questions

### Is my Synology NAS at risk from C3RB3R ransomware?

Devices running outdated DSM versions are the ones Synology warned about on October 29, 2026. Check your build in DSM Control Panel and compare it with the fixed builds for your branch. One source says DSM 7.0 and 7.1 have no patch, so owners on those branches may need a major-version upgrade.

### How can I tell if C3RB3R has encrypted my files?

Look for files with a .L0CK3D extension and a ransom note named read-me3.txt in folders. Those are the markers in public reporting so far. Synology has not published indicators of compromise, so a clean search does not guarantee a clean device.

### Will updating DSM decrypt files that are already locked?

No. Updating blocks new infections, but it does not recover files that are already encrypted. Synology has not published a decryptor, so restoring from backups stored offline or separately is the main recovery path.

### Which CVE was used in the Synology ransomware attacks?

The reporting does not settle this. A Synology spokesperson pointed to the 2024 advisory SA-24:20 and did not name a CVE. Qihoo 360 names CVE-2026-13639 and CVE-2026-13684, which Synology fixed in SA-26:13 on September 18, 2026.

## Sources

1. [Synology warns of C3RB3R ransomware attacks targeting NAS devices (BleepingComputer)](https://www.bleepingcomputer.com/news/security/synology-warns-customers-of-ongoing-c3rb3r-ransomware-attacks/)
2. [Synology NAS Devices Targeted in Ransomware Attacks Exploiting Patched DSM Flaw (The Hacker News)](https://thehackernews.com/2026/11/synology-nas-devices-targeted-in.html)
3. [CVE-2026-13639: C3RB3R Ransomware Hits Synology NAS, Update DSM (CyberExperts)](https://cyberexperts.com/2026-10-30-synology-dsm-c3rb3r-ransomware/)
4. [Ransomware: C3RB3R Ransomware Targeting Synology NAS Devices (CUHK IT Services)](https://www.itsc.cuhk.edu.hk/all-it/information-security/information-security-alerts/ransomware-c3rb3r-ransomware-targeting-synology-nas-devices/)
5. [Synology NAS Ransomware Alert: C3RB3R Locks Files With .L0CK3D (Techaeris)](https://techaeris.com/2026/10/31/synology-nas-ransomware-alert-c3rb3r/)
6. [Synology NAS Ransomware: C3RB3R Patch, Check And Detect (Ciphers Security)](https://cipherssecurity.com/synology-nas-ransomware-c3rb3r/)
7. [Synology NAS Ransomware Hits Outdated DSM: What to Do (Technine)](https://technine.io/en/blog/synology-nas-ransomware-outdated-dsm)
8. [Synology NAS Ransomware Hits Critical Flaws Left Unpatched (Obsonis)](https://www.obsonis.com/decoded/synology-nas-ransomware/)
9. [Synology NAS C3RB3R Ransomware Attacks: Update DSM and Check Your Backups (WindowsForum)](https://windowsforum.com/news/synology-nas-c3rb3r-ransomware-attacks-update-dsm-and-check-your-backups.450580/)
10. [Synology C3RB3R Ransomware: SA-26:13 vs SA-24:20 Fixes (DEV Community)](https://dev.to/shaam_ai/synology-c3rb3r-ransomware-sa-2613-vs-sa-2420-fixes-11dj)
11. [C3RB3R Ransomware Hits Unpatched Synology NAS Devices Through Flaws Fixed Almost Two Years Ago (DEV Community)](https://dev.to/etairos/c3rb3r-ransomware-hits-unpatched-synology-nas-devices-through-flaws-fixed-almost-two-years-ago-18d1)
12. [Synology DSM Ransomware Wave (C3RB3R) (Rescana)](https://www.rescana.com/post/synology-dsm-c3rb3r-ransomware-sa-24-20-prepare-now)