⚠ Active campaign — patch now
Synology NAS Security Guide: C3RB3R, CVE History and How to Lock Down DSM
Synology is the current epicenter of NAS ransomware: the C3RB3R campaign (October 2026) encrypts files with a .L0CK3D extension and even the DSM system partition. Synology was also a secondary target of eCh0raix in 2020. None of this required a true zero-day — just unpatched, internet-facing DSM.
Incident history
- 2020–2021 — eCh0raix: Unit42 documented a variant combining QNAP and Synology targeting; small Synology exposure (~3,500 internet-facing devices) kept damage limited.
- October 2026 — C3RB3R (Cerber variant): global campaign; entry attributed by Qihoo 360 to CVE-2026-13639/13684 (patched 18 Sep 2026) and by Synology to CVE-2024-10441 (patched Dec 2024); ransom ~$3,000 in BTC; Korea KISA and Macau police warnings. Separately, PHP2Shell exploits hit PHP packages (CISA KEV).
Your three checkpoints
- DSM build ≥ 7.4-90075 / 7.3.2-86009-4 / 7.2.2-72806-9 / 7.2.1-69057-12 (see CVE pages for details). DSM 6.x = no patch = isolate.
- Exposure: no forwarded 5000/5001; QuickConnect or VPN instead; firewall default-deny.
- Recovery net: Snapshot Replication on Btrfs volumes + Hyper Backup to an off-box target (3-2-1).
Then run the full 12-step checklist. Hit already? Recovery guide — mind the Encryption Key Vault trap.
FAQ
Which Synology models are affected by C3RB3R?
The campaign doesn't target a model — it targets DSM builds below the patched releases (or any internet-exposed DSM 6.x box). A 2019 DS220+ on DSM 7.2.2-72806-9 is protected; a 2024 DS923+ on an old 7.2.1 build is not. Check the build, not the model.
Does Synology have a decryptor for C3RB3R?
None confirmed as of 31 October 2026. Recovery paths are snapshots, off-NAS backups, cloud version history, or memory forensics (c3rb3r-rescue method). Watch Synology's security advisory page for updates.
Is QuickConnect safe to keep using?
Yes, comparatively — it avoids exposing DSM's login page directly. Keep it, add 2FA and auto-block, and keep DSM updated. The dangerous pattern is forwarded admin ports, not the relay.