Synology Warns of NAS Ransomware Attacks: What C3RB3R Means for IT Teams and How to Respond

On October 29, 2026, Synology told customers that attackers were exploiting a DiskStation Manager (DSM) vulnerability patched in December 2024, and the Chinese security firm 360 published research on C3RB3R, a Cerber-family ransomware hitting Synology NAS devices. The two reports disagree on the exact entry point.

For IT teams, the practical message is the same either way: NAS devices that are exposed to the internet or running outdated DSM builds are being encrypted, and recovery depends on backups that ransomware cannot reach. This article summarizes what is known as of November 2, 2026, and what to do now.

What Happened

360 reported handling multiple Synology NAS ransomware cases since early October 2026 and attributed them to C3RB3R, a variant of the long-running Cerber family. Synology issued its own notice on October 29, 2026 urging customers to update DSM.

• Symptoms: encrypted files carry a .L0CK3D extension (with a zero) and a ransom note named read-me3.txt appears in folders, according to GridinSoft's summary of the 360 report.
• Encryption: 360 describes ChaCha8 file encryption with keys protected by an embedded RSA-2048 public key, so renaming files back does not restore them.
• Synology's position: the vendor said attackers are exploiting a flaw patched in December 2024.
• 360's position: the firm linked the cases it investigated to two critical DSM flaws, CVE-2026-13639 and CVE-2026-13684, fixed on September 18, 2026 in advisory SA-26:13.

The public record does not establish that both accounts describe the same victims, and the mismatch is not evidence of a zero-day. The details are covered by IT-Connect's report and Synology's own security advisory index, which lists SA-26:13 for DSM as critical and resolved, plus the later PHP2Shell advisory SA-26:14.

Why It Matters

NAS devices often hold file shares, virtual machine datastores and backup repositories, so one encrypted unit can take down many workflows at once. When the backup target sits on the same network and credentials as production, ransomware can reach both.

The incident also shows a recurring pattern: attackers use flaws that were patched long ago, and many devices stay unpatched because storage appliances sit outside normal patch cycles. Guidance such as the NIST SP 1800-25 guide on identifying and protecting assets against ransomware stresses asset inventory for exactly this reason.

What It Means for B2B SaaS Buyers and IT Teams

Teams relying on a NAS for office files, media or backups should treat it as an internet-facing risk until proven otherwise. SaaS companies and agencies with small offices often keep a Synology box that nobody owns, and that is the profile attackers look for.

• Patch posture: your patch process must include storage appliances and their packages, not just laptops and servers.
• Backup design: backups need offline or immutable copies, because RAID is redundancy, not a backup.
• Exposure: management interfaces should not be reachable from the internet; remote access should go through a VPN or zero-trust gateway.
• Vendor risk: ask suppliers who hold your data on NAS hardware how they patch it and where their backups live.

What to Do Now: A Checklist

Update DSM first, then reduce exposure, then verify backups. The fixed DSM versions named in Synology's September advisory, as reported, are 7.4-90075, 7.3.2-86009-4, 7.2.2-72806-9 and 7.2.1-69057-12 or later; confirm against Synology advisory SA-26:13 before relying on these numbers.

• Update DSM and installed packages, and turn on automatic updates.
• Remove port forwards to DSM and use a VPN for remote access.
• Disable default admin accounts, enable two-factor authentication and automatic IP blocking.
• Enable write-protected snapshots and keep at least one offline copy of critical data.
• If a device is hit: isolate it from the network, preserve the ransom note and logs, contact Synology Support or an incident responder, and keep encrypted originals.
• Do not pay or trust decryptor promises without expert advice; no free decryptor is confirmed in the reports reviewed.

Related SaaSPodium Categories

Three software categories map directly to the controls above: patching closes known holes, backup tools provide recovery that ransomware cannot reach, and vulnerability management finds exposed or outdated assets before attackers do. Use the links below to compare tools.

Software that reduces this risk includes Patch Management Software, Backup & Recovery Software and Vulnerability Management Software. For a recent comparable edge-device incident, see our guide to the Ivanti Connect Secure zero-day chain.

Vendor background: Synology publishes its advisories and DSM update notes on its website.

Frequently Asked Questions

Which Synology devices are affected by C3RB3R ransomware?
Reports describe NAS devices running outdated DSM versions, not specific models. Check your DSM build against the fixed versions in Synology's advisory SA-26:13 and update, regardless of model.

Can I decrypt files locked with the .L0CK3D extension?
No confirmed free decryptor was found in the reports reviewed. Restoring from a clean backup or snapshot taken before the attack is the reliable route, so isolate the device and keep the encrypted originals.

Is RAID enough protection against ransomware?
No. RAID protects against disk failure, but ransomware encrypts every writable volume it can reach. Keep immutable or offline backups and write-protected snapshots in addition to RAID.