Synology warns: C3RB3R ransomware is encrypting outdated NAS devices
Attackers are encrypting Synology NAS devices on outdated DSM with C3RB3R ransomware. Synology points to a 2024 flaw, 360 to two from September 2026. Both are patched. Here's what to do now.
Translated from the German original with an AI language model, approved by me. Read the original
Synology rarely issues public attack warnings. The last one came in 2019, after brute-force attacks spread the eCh0raix ransomware. On October 29, 2026, the company issued another one: attackers are exploiting a vulnerability on NAS devices running outdated DiskStation Manager (DSM, the operating system on Synology NAS), encrypting the data and demanding a ransom. BleepingComputer and heise Security both covered it.
What has changed since my post
On X and in the WhatsApp channel, I said the reports named neither the affected versions nor a CVE. That's no longer true. There are now two explanations, and they don't fully match:
- Synology doesn't say outright which flaw is being exploited. It only says the flaw was fixed in December 2024 and links to advisory Synology-SA-24:20. That advisory covers flaws shown at Pwn2Own 2024, including CVE-2024-10441, a remote code execution bug rated 9.8 out of 10 on the CVSS scale. Remote code execution means an attacker can run their own code on the device over the network.
- Chinese security firm 360 examined affected devices. According to Gridinsoft, 360 traces the attacks to CVE-2026-13639 and CVE-2026-13684. Both are also rated 9.8 and appear in Synology-SA-26:13, published September 18, 2026. They let attackers read and write arbitrary files without logging in.
Nobody outside can tell which explanation is right. Both could be, if different attackers use different flaws. In practice it barely matters, because updates exist for both. But according to 360's analysis, installing only the 2024 patch doesn't automatically make you safe.
What the attack looks like
According to BleepingComputer, the first victims posted on forums and Reddit more than two weeks before Synology's warning. Encrypted files get a .L0CK3D extension, and a ransom note called read-me3.txt is left in the folders. The note claims that recovery software will destroy the files and that only the attackers' "C3rb3r Decryptor" will work. It costs several thousand dollars through a dark web portal. As proof, the attackers offer to decrypt one file for free. There is no free decryptor so far.
The name comes from Cerber, a ransomware that was rented out as a service starting in 2016. C3RB3R itself has been around since late 2021. Until now it has mostly hit Confluence and GitLab servers.
Who is affected
Any Synology NAS running a DSM version that still has one of these flaws is affected. Devices whose web interface can be reached from the internet are most at risk. BleepingComputer cites Shadowserver counting more than 380,000 Synology NAS devices exposed online. How many of them are patched is unknown.
Minimum versions from the two advisories:
| DSM | Fix from SA-24:20 | Fix from SA-26:13 |
|---|---|---|
| 7.4 | – | 7.4-90075 |
| 7.3 | – | 7.3.2-86009-4 |
| 7.2.2 | 7.2.2-72806-1 | 7.2.2-72806-9 |
| 7.2.1 | 7.2.1-69057-6 | 7.2.1-69057-12 |
Older branches such as 7.1 and 6.2 appear only in SA-24:20. If you're still on one of them, move to a supported branch if your model allows it.
What you should do now
- Update DSM right away, to the latest available version, not just the 2024 patch. Then turn on automatic updates, as Synology recommends.
- Keep the management interface off the internet. For remote access, use a VPN (an encrypted tunnel into your own network) instead of forwarding a port on your router.
- Keep backups separate from the NAS, either offline or on a system the NAS can't write to. Snapshots on the same device won't help if the attacker controls the whole device.
- If you're hit, don't rush to pay. Disconnect the device from the network and save the ransom note and some sample files. Then contact Synology support and, if needed, an incident response provider.
My take: updating is mandatory, but it isn't the core problem. The 2024 flaws have been fixed for almost two years and are still being exploited. A NAS that sits open on the internet and never gets updated will be exposed again with every new flaw. The best protection is to never make the device reachable from the internet in the first place.