Synology DSM: C3RB3R Ransomware Hits Unpatched NAS

What to do

1. Check the DSM version on every Synology device (Control Panel > Info Center, or cat /etc.defaults/VERSION over SSH).
2. Update to at least 7.4-90075, 7.3.2-86009-4, 7.2.2-72806-9 or 7.2.1-69057-12, or the newest build for your model, and turn on automatic DSM updates.
3. Remove router port forwards to DSM and reach it over a VPN instead; limit admin access with the DSM firewall.
4. Disable the default admin account, enforce strong passwords and 2FA, and enable auto-block for failed logins.
5. Enable scheduled shared-folder snapshots with immutability and keep at least one backup that is offline or off the NAS.

How to check if you are affected or compromised

• Search shares for the ransom note and extension: find /volume1 -name 'read-me3.txt' -o -name '*.L0CK3D' | head.
• Review DSM Log Center for unfamiliar logins, new admin accounts and bursts of file modifications since early October 2026.
• Scan for the 360-published sample MD5 a1375e0f82ae86df528876c049b5a23c.
• If you find signs, disconnect the NAS from the network before rebooting or resetting, and preserve logs and a ransom note.

What happened#

On October 29, 2026, Synology published a notice urging customers to update DiskStation Manager (DSM). Attackers are exploiting a known vulnerability on devices running outdated DSM to "encrypt data and demand a ransom." Synology says the vulnerability was patched in December 2024 and points to Synology-SA-24:20. That advisory was first published November 5, 2024, and its critical entry is CVE-2024-10441, an unauthenticated remote code execution flaw in the system plugin daemon (CVSS 9.8).

The same day, Chinese security vendor 360 published an incident analysis after receiving "multiple" requests for help from Synology owners in October. 360 attributes the incidents it handled to two newer bugs from Synology-SA-26:13 of September 18, 2026. CVE-2026-13639 is insufficient entropy in DSM login logic. CVE-2026-13684 is an output-encoding flaw in SCGI. Both are rated CVSS 9.8, and both let unauthenticated remote attackers read or write arbitrary files. 360 calls this a 1-day attack.

360 identifies the malware as a Cerber variant that names itself C3RB3R. It skips 27 system directories, encrypts each file with ChaCha8 under a per-file key protected by an embedded RSA-2048 key, appends .L0CK3D to file names, and drops read-me3.txt in each folder. As Gridinsoft notes, the two reports don't establish whether they describe the same victims or the same entry route. Synology has not named a specific CVE or given a victim count as of November 3, 2026.

Who is affected#

Whichever account is right, the answer for owners is the same. You are at risk if your DSM is older than the SA-26:13 fixed builds:

DSM branch	Minimum fixed build (SA-26:13)
7.4	7.4-90075
7.3	7.3.2-86009-4
7.2.2	7.2.2-72806-9
7.2.1	7.2.1-69057-12

SA-26:13 lists no fixed build for DSM 7.2.0, 7.1 or older. Its CVE records describe every DSM before those builds as affected, so devices on older branches need to move to a supported branch. Devices on DSM 7.2.2 before 7.2.2-72806-1, 7.2.1 before 7.2.1-69057-6, or 7.2 before 7.2-64570-4 are also exposed to the older CVE-2024-10441 that Synology cites.

Do you really need to act?#

Yes, if any Synology box in your company or home lab is behind on DSM. These are unauthenticated network bugs with public patches, and a ransomware crew is now using them. NAS devices often hold the backups, design files and exports that teams would need in order to recover from anything else, and many are reached through router port forwards that nobody remembers setting up.

Exposure matters. Neither Synology nor 360 has described the exact network path. 360's advice to stop exposing NAS management ports to the internet suggests direct reachability is the main risk. A fully patched DSM that is reachable only over VPN is at low risk from this campaign. None of the three CVEs is in CISA KEV as of November 3, 2026, but vendor-confirmed ransomware exploitation is reason enough to act.

What to do now#

1. Check the version. In DSM go to Control Panel, Info Center, or over SSH run cat /etc.defaults/VERSION.
2. Update to the newest DSM build for your model, at least the build in the table above. Turn on automatic DSM updates, as Synology recommends. SA-26:13 lists no workaround.
3. Remove router port forwards to DSM and use a VPN for remote access. Restrict the DSM firewall to the addresses that need admin access.
4. Disable the default admin account, require strong passwords and 2FA, and enable auto-block for repeated failed logins.
5. Turn on scheduled shared-folder snapshots with immutability. Keep at least one backup that is offline or stored off the NAS, and test a restore. A copy on the same NAS does not protect you.

How to tell if you were hit#

Run find /volume1 -name 'read-me3.txt' -o -name '*.L0CK3D' | head over SSH, and repeat for each volume. In Log Center, look for logins you don't recognize, new administrator accounts, and bursts of file changes since early October 2026. 360 published one sample MD5, a1375e0f82ae86df528876c049b5a23c. If you find signs of compromise, disconnect the NAS from the network first, because encryption keeps going while DSM runs. Then preserve a ransom note, sample files, the DSM version, the package list and the logs. Check that your snapshots and off-device backups predate the attack, and contact Synology Support before you reset anything. Updating DSM closes the entry point but does not decrypt files.

Timeline#

• Nov 5, 2024 — Synology publishes SA-24:20, which includes CVE-2024-10441. Synology's notice says the fix landed in December 2024.
• Sep 18, 2026 — Synology publishes SA-26:13, fixing CVE-2026-13639, CVE-2026-13684 and six other bugs.
• Oct 2026 — 360 receives multiple incident-response requests from Synology owners hit by C3RB3R.
• Oct 29, 2026 — Synology urges DSM updates, and 360 publishes its analysis.
• Nov 3, 2026 — Synology has still not named a specific CVE or given a victim count, and no CVE is in CISA KEV.

Vulnerability records

• CVE-2026-13639 · An insufficient entropy vulnerability in login logic in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075…
• CVE-2026-13684 · An improper encoding or escaping of output vulnerability in SCGI in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and…
• CVE-2024-10441 · Improper encoding or escaping of output vulnerability in the system plugin daemon in Synology BeeStation OS (BSM) before 1.1-65374 and Synology DiskStation…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Synology — Synology urges users to update DSM following ransomware attacks on outdated DSM versions synology.com
2. Synology — Security Advisory Synology-SA-26:13 DSM synology.com
3. Synology — Security Advisory Synology-SA-24:20 DSM (PWN2OWN 2024) synology.com
4. CVE.org — CVE-2026-13639 cve.org
5. CVE.org — CVE-2026-13684 cve.org
6. CVE.org — CVE-2024-10441 cve.org
7. 360 Security — Cerber variant ransomware attacks on Synology NAS (Chinese) 360.cn
8. Gridinsoft — Synology NAS ransomware locks files as sources disagree on entry blog.gridinsoft.com