Synology is urging NAS owners to update now as C3RB3R ransomware hits outdated boxes

Synology told owners of its network-attached storage devices on 29 October to install the latest DiskStation Manager software at once, after attackers began encrypting data on boxes that were running outdated releases. The ransomware, known as C3RB3R, renames victims’ files with a .L0CK3D extension and leaves a ransom note called read-me3.txt. Synology says the intrusions exploit a vulnerability that it patched in December 2024.

Tech news in one quick read: Get the most interesting stories in startups, tech and programming, each with a short TLDR, in one daily email from TLDR.

Subscribe to TLDR →

We may earn a commission if you sign up.

A NAS box often holds a household’s photo library, a small office’s shared drive and, in many cases, the backups of other computers. When one is locked, the loss can reach the copies that were supposed to provide protection. The first practical step is to read the installed DSM version in the control panel and compare it with the fixed releases listed below, because the patches are published per version line rather than as one universal build.

BleepingComputer, in a report published on 2 November, said Synology strongly urges all users running vulnerable versions to update DSM immediately and to enable automatic updates. The company’s own press statement from Taipei uses the same wording about targeting devices on outdated DSM. Such warnings are rare from the vendor: the previous one came in August 2019, after brute-force attacks led to eCh0raix ransomware infections.

Fixed DSM releases in advisory SA-24:20

Synology points to security advisory SA-24:20, published on 5 November 2024 and rated critical. It covers three flaws: CVE-2024-10441, a remote code execution bug in the system plugin daemon scored 9.8; CVE-2024-50629, a limited file-read flaw in the web API scored 5.3; and CVE-2024-10445, a limited file-write flaw in update functionality scored 4.3. Synology has not said which of them the attackers are using.

• DSM 7.2.2: version 7.2.2-72806-1 or later
• DSM 7.2.1: version 7.2.1-69057-6 or later
• DSM 7.2: version 7.2-64570-4 or later
• DSM 7.1: version 7.1.1-42962-7 or later
• DSM 6.2: version 6.2.4-25556-8 or later

Synology also advised blocking access to the management web interface from the internet, which removes the most direct route for remote attackers regardless of patch level. Owners who rely on remote access can use a VPN rather than leaving the login page open to anyone who scans the internet, and a router check for forwarded ports is a quick way to confirm nothing is exposed by accident. Automatic updates matter here because the flaws at issue were fixed nearly two years before the current attacks, so devices still being hit have simply gone without maintenance since.

Shadowserver’s 380,000 exposed devices and a disputed entry point

The Shadowserver Foundation tracks more than 380,000 internet-exposed Synology NAS devices, according to BleepingComputer. That figure counts exposure, not infection: it does not say how many of the devices are patched, how many are vulnerable, or how many are decoys set up by researchers. Reports from victims who found encrypted data surfaced more than two weeks before the BleepingComputer article, which suggests the campaign had been running for some time before the vendor spoke publicly.

The picture is less settled on the entry route. A Gridinsoft write-up says security firm 360 published its own analysis on 29 October and attributed its incidents to CVE-2026-13639 and CVE-2026-13684, disclosed in September 2026 under advisory SA-26:13. Gridinsoft notes that the reports do not establish whether they describe the same victims or the same route. It lists minimum fixed releases for that second advisory of 7.4-90075, 7.3.2-86009-4, 7.2.2-72806-9 and 7.2.1-69057-12, and the practical advice is to move to the newest release available for the model rather than stop at a minimum.

Recovery after a .L0CK3D infection and the backup question

C3RB3R borrowed its name from the Cerber ransomware-as-a-service operation that emerged in 2016 and, by BleepingComputer’s account, accounted for more than 80 percent of ransomware attacks before it vanished at the end of 2019. Since December 2021 the C3RB3R name has also been tied to attacks on Atlassian Confluence and GitLab servers through CVE-2021-26084, CVE-2021-22205 and CVE-2023-22518. The note tells victims that the only safe way to recover files is to buy a tool called the C3rb3r Decryptor, and it reportedly demands thousands of dollars through a dark-web portal. That claim is the attacker’s sales pitch, and a paid decryptor carries no guarantee of working.

Updating DSM closes the door but does not decrypt anything already locked. Gridinsoft’s incident steps start with isolating the device from the network, preserving the ransom note, encrypted samples, version details and logs before any reset, and checking whether snapshots or backups predate the attack. It cautions that a copy sitting on the same compromised storage is not a guaranteed recovery source. The Cybersecurity and Infrastructure Security Agency’s ransomware guide makes the related point that many variants hunt for accessible backups to delete or encrypt, and it recommends keeping encrypted backups offline and testing them regularly.

Two questions are still open. Synology has not named the exploited CVE, and BleepingComputer’s request for comment went unanswered when its article ran, while 360’s different CVE numbers leave the actual path unresolved for owners deciding how urgent a given firmware build is.

This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.

Tech news in one quick read: Subscribe to TLDR →

We may earn a commission if you sign up.