Synology NAS ransomware is now encrypting files on home and small-office storage boxes that run outdated DiskStation Manager (DSM) software. The strain, called C3RB3R, locks shared folders, business documents and backups. The device maker and the Chinese security firm 360 disagree about which software flaw lets the attackers in.
How Synology NAS ransomware C3RB3R encrypts files
Both sides went public on October 29, 2026. According to CyberExperts' write-up, 360's anti-ransomware team had handled repeated attacks on Synology NAS devices by C3RB3R, which it describes as a variant of Cerber, a long-running ransomware family. Synology confirmed the attacks in its own statement that day and told users on older DSM releases to update right away and turn on automatic updates, as reported by Pasquale Pillitteri and ipsip.
The campaign is aimed at US home offices and small businesses that keep files and backups on a NAS. Those are the setups where a single box often holds everything.
The attacks reportedly began in early October 2026, according to TrebSec. Encrypted files get renamed with a .L0CK3D extension, and each folder receives a ransom note called read-me3.txt, as IT-Connect reports.
Reported victim data includes shared folders, business development documents, database images and routine backup files, according to Guru3D. For a small office, the backup files may be the most painful loss, because they are usually the copies people would restore from.
Researchers say the attacks target devices exposed to the internet and need no account or password to reach the DSM layer. That detail undercuts a common assumption. A strong admin password does not help much if the attacker never has to log in.
One report puts the ransom demand at about $2,952 in bitcoin, doubling after five days. That figure comes from a single source and has not been verified.
Which DSM builds include the fix
The coverage cites the following minimum fixed builds. Each one is the minimum for its branch, and any later build in that branch counts as fixed. The builds appear in TrebSec's brief and IT-Connect's guide.
| DSM branch | Minimum fixed build |
|---|---|
| DSM 7.4 | 7.4-90075 |
| DSM 7.3.2 | 7.3.2-86009-4 |
| DSM 7.2.2 | 7.2.2-72806-9 |
| DSM 7.2.1 | 7.2.1-69057-12 |
According to 360, Synology's fixes shipped on September 18, 2026. The two critical DSM flaws it names, CVE-2026-13639 and CVE-2026-13684, were addressed in Synology advisory SA-26:13, as NASCompares notes.
One responder, Solar, reported a victim already running DSM 7.4.1 and suspects a zero-day, according to Pillitteri's report. Nobody has published proof. Treat that as an open lead, not a finding.
Why Synology and 360 disagree on the entry point
Synology ties the attacks to a vulnerability it patched in December 2024, referenced as advisory SA-24:20, according to ipsip. The security firm 360 points instead to the September 2026 flaws. Synology has not published a victim count or a full entry-route analysis for every incident.
The answer changes how many people are exposed. If the December 2024 flaw is the way in, any NAS that never installed that patch has been open for nearly two years. If the September 2026 flaws are the cause, the fix has been public for about six weeks, and the owners at greatest risk are the ones who have not installed it yet. Both scenarios point to the same action: update and close the internet path.
Researchers also cite other possible routes. Those include Docker-container remote code execution and a Synology package flaw linked to PHP2Shell, according to Guru3D. Synology's advisory SA-26:14 reportedly covers PHP core flaws CVE-2026-109618 and CVE-2026-109619 in native packages. CISA added those two PHP CVEs to its Known Exploited Vulnerabilities catalog on October 26.
For another recent catalog addition, see our coverage of the Ivanti Connect Secure flaws that CISA added to KEV. For a Linux example, see the Fragnesia listing ahead of its deadline.
Some reporting notes that the disagreement is not proof of a new zero-day, an attack on fully updated DSM or a vendor compromise, according to Gridinsoft. That caution cuts both ways. Nobody has proved a zero-day, but nobody has ruled one out either.
Synology hardware has been targeted before. In 2014 a strain called Synolocker hit its NAS boxes, according to an archived copy of The Register's coverage.
How to tell if your Synology NAS is infected
Two markers have been reported so far. Search your shared folders for files ending in .L0CK3D, and look for a ransom note named read-me3.txt in each folder. Some reports write the extension with a letter O, as .LOCK3D, so search for both spellings. Coverage of that spelling appears in Noransom's recovery guide and IT-Connect.
No encrypted files does not mean the device is safe. An exposed, outdated DSM is a risk on its own, and it can be a foothold before any encryption starts.
What to do now if your NAS is exposed
Work through these steps in order.
- Check your DSM version against the table above. If it sits below the fixed build for its branch, install the update and turn on automatic updates.
- Remove direct internet exposure of DSM. Synology's hardening guidance, as summarized by Gridinsoft, advises against exposing DSM directly to the internet and recommends a VPN for remote file access.
- Confirm you have a current backup stored offline or off the device. No free decryptor had been released as of October 30, and Synology does not offer one, so a clean backup is the most reliable recovery path.
- If files are already encrypted, disconnect the NAS from the network. Before any reset, preserve the ransom note, sample encrypted files, the DSM version, the package list and the logs. A Windows antivirus scan cannot repair DSM or decrypt the files, so do not count on one.
What comes next for Synology NAS owners
Several questions remain open. Synology has not said whether it will publish a new advisory or extend fixes to older DSM branches. The entry point is still disputed, and the victim count and ransom figure are unverified. Coverage so far is concentrated in Chinese and English-language outlets, so the campaign's reach elsewhere is unclear.
Three signals matter most. A new Synology advisory that names a single entry point would settle the dispute. A confirmed zero-day would change the risk picture, though not the core advice. A free decryptor would change recovery options for victims without a clean backup. Until one of those arrives, the job is the same as it was before this story: patch, pull DSM off the open internet and test a restore.
