Synology C3RB3R ransomware is encrypting internet-exposed Synology NAS devices that run outdated DSM, and the verdict is simple: install a DSM build that satisfies the newer advisory, SA-26:13, because it also supersedes the older SA-24:20 fix. On October 29, 2026, Synology publicly warned that attackers are exploiting a flaw patched in December 2024, and BleepingComputer reported the wave on November 2, 2026. Two September 2026 flaws, CVE-2026-13639 and CVE-2026-13684, both carry a CVSS score of 9.8 and are the entry points named by one security vendor, so patching to the newest build closes both possibilities at once.
TL;DR
- C3RB3R is a Cerber-family variant. It appends
.L0CK3Dto files and dropsread-me3.txtin each folder. - Synology points to a flaw fixed in December 2024 (SA-24:20); Qihoo 360 names two flaws fixed in September 2026 (SA-26:13). Neither claim is confirmed.
- Patching to a SA-26:13 build covers both advisories on every supported DSM branch listed below.
- Block the DSM management interface from the internet and turn on automatic updates.
- No public decryptor exists. Isolate an infected unit before assessing scope.
- There is no victim count; the only scale figure is open-internet exposure.
What is Synology C3RB3R ransomware and how does it work?
Synology C3RB3R ransomware is a file-encrypting threat that Qihoo 360's anti-ransomware team classifies as a Cerber variant. The team says it began fielding help requests from NAS owners in early October 2026; all malware-analysis claims here come from its sampling, and Synology has not confirmed them.
According to Qihoo 360, each file gets its own 256-bit ChaCha8 key wrapped with an embedded RSA-2048 key and appended to the file. It fully encrypts the 187 priority extensions, partially encrypts others, and skips 27 system directories, keeping the NAS running so the victim can read the note.
The note tells victims to buy a "C3rb3r Decryptor" from a dark-web portal, and each note carries a six-digit device ID. Qihoo 360 lists the analysed sample's MD5 as a1375e0f82ae86df528876c049b5a23c.
Which advisory matters more: SA-26:13 or SA-24:20?
Both matter, but SA-26:13 is the one to aim for. Synology's own warning refers to a vulnerability patched in December 2024, which maps to advisory Synology-SA-24:20. Qihoo 360 instead attributes the intrusions to flaws fixed in Synology-SA-26:13, published September 18, 2026. Synology has not said which flaw the current wave uses, so a cautious admin treats both as live.
| SA-24:20 (December 2024) | SA-26:13 (September 2026) | |
|---|---|---|
| Who names it | Synology, in its October 29 warning | Qihoo 360, as a "1-day" attack |
| CVEs | CVE-2024-10441 (remote code execution, CVSS 9.8), CVE-2024-50629 (file read), CVE-2024-10445 (file write) | CVE-2026-13639 (insufficient entropy in login logic, CVSS 9.8), CVE-2026-13684 (improper output encoding in SCGI, CVSS 9.8) |
| Attacker position | Remote | Remote, unauthenticated, arbitrary file read or write |
| Confirmed by Synology | Referenced, exact flaw not stated | Not confirmed |
| Minimum fixed builds | 7.2.2-72806-1, 7.2.1-69057-6, 7.2-64570-4, 7.1.1-42962-7, 6.2.4-25556-8 | 7.4-90075, 7.3.2-86009-4, 7.2.2-72806-9, 7.2.1-69057-12 |
The practical difference is build numbers: on shared branches the SA-26:13 build is later, so reaching it satisfies both advisories. But DSM 7.2, 7.1.1 and 6.2.4 appear only in the SA-24:20 list, so those units cannot reach the September fix without a newer branch. If a unit is stuck there, patching still helps, but taking it off the internet is the stronger control.
How do I protect a Synology NAS from C3RB3R right now?
Work through these steps in order; build numbers come from Synology's two advisories.
- Check your DSM version under Control Panel, then Update & Restore.
- Update to 7.4-90075, 7.3.2-86009-4, 7.2.2-72806-9 or 7.2.1-69057-12 or above. These cover SA-26:13 and, on the same branches, SA-24:20.
- If you cannot reach those builds, install at least 7.2-64570-4, 7.1.1-42962-7 or 6.2.4-25556-8 from SA-24:20, then plan a migration to a supported branch.
- Turn on automatic updates, which Synology explicitly recommends.
- Remove the DSM web interface from the internet. Disable router port forwarding to the NAS and switch off QuickConnect and other external access unless you need it. Use a VPN for remote administration instead.
- Hunt for indicators: files ending in
.L0CK3D,read-me3.txtin any folder, and the MD5 above. A hit means you should assume compromise, whatever your DSM version now says.
Patching does not repair a unit that was already breached. An attacker with arbitrary file write may have left persistence, so a patched box with the indicators present is still an incident. Edge appliances fail the same way, as in our Ivanti Connect Secure zero-days and CISA patch deadline coverage.
What should I do if my Synology NAS is already encrypted?
Isolate the device from the network first, by unplugging the network cable rather than powering it off. ThaiCERT's advisory of November 3, 2026 recommends preserving evidence, keeping the ransom note and logs, and assessing scope before any recovery or rebuild. Wiping first destroys the information you need to learn how the intruder got in.
Do not pay: no free decryptor existed as of November 2, 2026, and payment guarantees nothing. Restore from a backup the NAS cannot write to, then rebuild on a patched build with credentials changed, and treat every account used with the device as exposed. Our AI agent sandbox containment playbook covers the same isolate-then-investigate order, and AI agent production access security covers limiting standing access.
How many Synology devices are exposed, and is this in CISA's KEV catalog?
Nobody has published a victim count. The figure in circulation, more than 380,000 internet-exposed Synology NAS units, comes from the Shadowserver Foundation dashboard. That measures exposure, not infections.
As of catalogue version 2026.11.04, released November 4, 2026, none of CVE-2026-13639, CVE-2026-13684 or CVE-2024-10441 appears in CISA's Known Exploited Vulnerabilities catalog. There has also been no law-enforcement announcement and no attribution to a named group or country. Absence from KEV is not a reason to wait, since entries often follow confirmed exploitation.
Does this affect NAS owners in India?
Yes: Indian small businesses and home labs commonly run Synology hardware, and the older flaw has long been on CERT-In's radar. CERT-In, India's national CERT, issued CIVN-2025-0052 on March 24, 2025, rated critical, covering the same three SA-24:20 CVEs that Synology's warning now points to. Any Indian user who ignored it is in the at-risk group. There is no CERT-In note yet for the September 2026 CVEs. For context on what this kind of exposure costs, see our DRDO breach report.
FAQ
Q: Is there a free decryptor for C3RB3R ransomware?
A: No public decryptor was available as of November 2, 2026. Restore from an offline or unmounted backup instead.
Q: Which DSM version is safe from C3RB3R?
A: Builds at or above 7.4-90075, 7.3.2-86009-4, 7.2.2-72806-9 or 7.2.1-69057-12 carry the SA-26:13 fixes. Synology has not confirmed which flaw the attackers use, so these builds are the safest available target.
Q: Which flaws does C3RB3R exploit?
A: Synology points to a flaw patched in December 2024 under SA-24:20, while Qihoo 360 names CVE-2026-13639 and CVE-2026-13684. Neither claim has been reconciled publicly.
Q: How can I tell if my NAS has been hit?
A: Look for files ending in .L0CK3D and a read-me3.txt note in folders, and search for the MD5 a1375e0f82ae86df528876c049b5a23c. These indicators come from Qihoo 360.
Q: Is turning off port forwarding enough to protect my Synology?
A: It removes the most direct route in, and Synology and BleepingComputer both advise blocking internet access to the management interface. It does not fix the underlying flaws, so you still need to update DSM.
Bottom line
For most owners the decision is not close. Update to a SA-26:13 build, turn on automatic updates, and take the management interface off the internet today. Keep one backup the NAS cannot write to; it is the only thing that turns this incident into an inconvenience.
Top comments (0)