Synology Ransomware: C3RB3R Hits NAS Devices Running Outdated DSM

Attackers are encrypting files on Synology network-attached storage devices that never received current DiskStation Manager (DSM) updates, and the campaign is still active nine days after Synology's warning. The ransomware is called C3RB3R. According to CyberExperts, Qihoo 360's anti-ransomware team saw repeated attacks on Synology NAS devices, and the activity has been running since early October. For US home users and small offices that keep backups on these boxes, the damage can land on the very copies meant to save them.

On October 29, 2026, Synology published a security alert warning that attackers were encrypting data on devices running outdated DSM versions and demanding ransom. In a statement quoted by BleepingComputer, the company said: "Synology strongly urges all users running vulnerable versions to update DSM immediately to protect their systems."

The attack path is a patch gap, not a new zero-day. The fixes already exist, some for months and one set for almost two years. For each owner, the real question is whether the device received them.

What the Synology ransomware attack does to files

C3RB3R is a variant of the Cerber ransomware family, according to CUHK IT Services. Encrypted files receive a ".L0CK3D" extension, and a ransom note named "read-me3.txt" appears in each folder, as The Hacker News reported. These are the most concrete markers in public reporting so far.

Synology has not published indicators of compromise or a decryptor, so a clean-looking folder does not prove a device is safe. The Hacker News covered the campaign on November 3, and a November 7 DEV Community analysis compared the SA-26:13 and SA-24:20 fixes. Coverage is still moving because the campaign is still live.

Which DSM versions are at risk

It is still unclear which flaw attackers used. Synology's own warning points to its older SA-24:20 advisory. When BleepingComputer asked which flaw was involved, a Synology spokesperson pointed back to that 2024 advisory and did not name a CVE.

360 offers a different account. According to CyberExperts, the attacks use two DSM flaws, CVE-2026-13639 and CVE-2026-13684, which Synology fixed on September 18, 2026 in advisory SA-26:13. 360 rates each at CVSS 9.8. A less authoritative Rescana analysis names CVE-2024-10441 as Synology's diagnosis, which conflicts with the company's statement that it named no CVE. That claim remains unconfirmed.

The two advisories list different builds, and the gaps matter. Blank cells mean the reporting did not list a fixed build for that branch under that advisory, not that the branch is safe.

Synology has not said whether DSM 7.2, 7.1 and 6.2 devices are affected by SA-26:13 or simply unsupported for it. One source describes DSM 7.0 and 7.1 as end-of-life with no patch, according to DEV Community. Owners on those branches may need a major-version upgrade rather than a point update.

One analysis cites Shadowserver tracking more than 380,000 Synology NAS devices exposed to the internet. That figure shows how many boxes could be reached, not how many have been encrypted. No source documents an encrypted-device count.

Synology has also released PHP updates for separate PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619, according to Technine. Those are a different threat, but they point to the same lesson about internet-facing software. USA 24 has covered active attacks on the PHP2Shell flaws aimed at firewall interfaces.

Steps to take on a Synology NAS today

• Check your DSM version. Open DSM Control Panel, note the installed build, and compare it with the fixed builds for your branch in the table above.
• Install the fixed build. Go to DSM Control Panel > Update and Restore and apply the update for your branch. If your device runs DSM 7.0, 7.1 or 6.2, a point update may not exist, so check whether your hardware supports a newer major version.
• Turn on automatic updates. This closes the gap for owners who would otherwise forget the device exists.
• Cut off the management interface. Block DSM management from the internet and remove any port forwards that expose it.
• Look for the reported markers. Search for files with the .L0CK3D extension and for read-me3.txt. Because Synology has not published indicators of compromise, a clean search does not prove the device is clean.
• Protect your backups. Keep at least one copy offline or stored separately. The update blocks new infections but does not recover files that are already encrypted.
• Hold off on any payment. Synology has not released a decryptor, so check for one before paying anything.

Why the patch gap is the bigger lesson

NAS boxes often sit in closets, run unattended and rarely get touched after setup. Attackers did not need a novel exploit here. They needed devices that had been left behind. The SA-26:13 fixes arrived roughly six weeks before Synology's October 29 warning, which gave anyone watching advisories a short head start and everyone else very little.

The winners are obvious. Home users and small businesses that treated a NAS as a set-and-forget file server or backup target carry the cost. Synology also faces a credibility question. Its warning and its spokesperson pointed to a 2024 advisory without naming a CVE, which makes it harder for administrators to match the alert to a specific patch.

The pattern is not unique to Synology. USA 24 told readers to check their SSLVPN appliances after SonicWall CVE-2026-19868 came under active attack. Devices with exposed management interfaces keep appearing in attack reports, and the same habit of delayed patching keeps paying off for attackers.

What to watch next

• Which CVE Synology says was exploited, and whether the company publishes indicators of compromise.
• Whether C3RB3R entered through the 2024 flaw, the 2026 flaws or both. 360 and Synology disagree on the entry point, according to Techaeris.
• How many devices have actually been encrypted. Only exposure counts are documented so far.
• Whether DSM 7.2, 7.1 and 6.2 devices receive fixes, or whether those branches are simply left behind.
• Who runs C3RB3R, and whether a decryptor appears.

The next useful signal is Synology's own advisory. If the company names the exploited CVE and publishes indicators, administrators can verify exposure far faster than they can by guessing from version strings. Until then, treat any internet-reachable NAS on an old DSM branch as in scope, and check your backups before you check anything else.