⚠ October 2026 — active campaignUpdated 2026-10-31
Synology C3RB3R Ransomware (October 2026): What Happened, Who's Affected, and the Fix
Since early October 2026, Synology NAS owners around the world have discovered their files renamed with a .L0CK3D extension and a ransom note named read-me3.txt in every folder. The malware — identified by Chinese security firm Qihoo 360 as C3RB3R, a variant of the long-running Cerber family — demands roughly 0.037 BTC (about $3,000), doubling after five days. Korea's KISA and Macau's judicial police have both issued public warnings; victims span Italy, Korea, China and beyond.
What the malware does
Once inside, C3RB3R scans the filesystem (skipping 27 system directories so the NAS keeps running), encrypts files with ChaCha8 using a per-file 256-bit key, wraps those keys with RSA-2048, appends the .L0CK3D extension, and drops read-me3.txt pointing to a Tor site. Several victims report the system partition itself was encrypted, leaving DSM unable to boot until reinstalled — and one DS2422+ owner found Volume 1 locked by the Encryption Key Vault after reinstalling, with the old vault password rejected.
How it gets in — two versions, stated as-is
- Qihoo 360's attribution: the samples it analyzed exploited CVE-2026-13639 and CVE-2026-13684 — two critical (CVSS 9.8) unauthenticated file read/write flaws in DSM, disclosed and patched on 18 September 2026 in advisory Synology-SA-26:13. A classic 1-day pattern: most victims simply hadn't updated yet.
- Synology's own statement (29 October): attackers are exploiting a vulnerability patched in December 2024 (SA-24:20, CVE-2024-10441) on devices running outdated DSM — not a new zero-day in current versions.
- One incident-response team reports a victim already on a recent DSM 7.4.1 build, with the entry route unconfirmed (packages, containers, or credentials not ruled out). Treat both versions as live until more data lands.
The exact patched builds
Whichever flaw was used, the fixed releases are the same checkpoints. Update to or beyond your branch's build:
| DSM branch | Fixed build |
|---|---|
| DSM 7.4 | 7.4-90075 |
| DSM 7.3.2 | 7.3.2-86009-4 |
| DSM 7.2.2 | 7.2.2-72806-9 |
| DSM 7.2.1 | 7.2.1-69057-12 |
DSM 6.x has no fix for these flaws. Models end-of-life on DSM 6 cannot patch SA-26:13 — the only safe posture is taking them off the public internet entirely (see the hardening checklist).
A trap victims keep reporting: DSM's update page said "you are fully updated" while the unit silently sat on an EOL branch that no longer receives auto-updates. Check Control Panel → Update & Restore manually, and compare your build number against the table above — don't trust the badge alone.
Already encrypted? Do this, in order
- Do not pay. Synology, KISA and every CERT that has commented advise against it; there is no confirmed free decryptor for C3RB3R.
- Don't rush to reboot or reinstall. The open-source c3rb3r-rescue project proved recovery keys can survive in memory (it fully decrypted a 49 GB GitLab backup) — but only if volatile memory is captured first. Powering off destroys that chance.
- Disconnect from the network (pull the cable), then follow our step-by-step locked-files recovery guide — snapshots, Encryption Key Vault, and what actually survives.
If you're not hit yet — 10 minutes now
Update DSM to the builds above, disable any admin account exposed to the internet, turn on auto-updates and 2FA, verify snapshots are running, and make sure one backup copy lives off the NAS. The full list is in the NAS hardening checklist; the backup strategy that survives ransomware is 3-2-1 (and better).
How this fits the pattern
NAS ransomware is not new: Qlocker hit QNAP in 2021, DeadBolt hit QNAP, Asustor and TerraMaster through 2022, and eCh0raix targeted QNAP and Synology as early as 2019. The playbook each time is identical — an internet-facing admin interface plus an unpatched flaw. See the full NAS ransomware history and your own vendor's page: QNAP, Asustor, TerraMaster.
FAQ
Is my Synology affected by C3RB3R?
Only if your DSM is below the patched builds (7.4-90075, 7.3.2-86009-4, 7.2.2-72806-9, 7.2.1-69057-12) or stuck on DSM 6.x. Check Control Panel → Info Center for your exact build, then Update & Restore. Model year doesn't matter — the DSM build does.
Is this a Synology zero-day?
By Synology's statement, no — attackers are using flaws patched in December 2024 (CVE-2024-10441) against outdated DSM. Qihoo 360's samples used CVE-2026-13639/13684, patched 18 September 2026. One unconfirmed case on DSM 7.4.1 is still under investigation, so patching plus reducing internet exposure remains the advice either way.
Should I pay the C3RB3R ransom?
No. Synology, KISA and Macau's PJ all advise against paying. There is no confirmed free decryptor, and paying funds the next campaign. Recovery realistically comes from snapshots, off-NAS backups, or (in some cases) memory forensics — see our recovery guide.
The ransomware encrypted DSM itself and it won't boot. Is my data gone?
Not necessarily. Reinstalling DSM does not touch volume data — but stop before reinstalling if you can: one victim lost access to an encrypted volume because the Encryption Key Vault was reset during reinstall. Follow the recovery guide order: capture memory if possible, disconnect, then reinstall.
Are QuickConnect and port forwarding safe?
QuickConnect is far safer than forwarded admin ports because DSM's login page isn't directly exposed. Historically, mass ransomware campaigns spread through directly exposed admin interfaces. If you don't need remote admin, remove the port forwards entirely and use VPN or QuickConnect.