Synology Ransomware: C3RB3R Is Hitting Outdated DSM, and How to Protect Your NAS

A Synology ransomware campaign is encrypting files on NAS devices that run outdated versions of DiskStation Manager (DSM). Synology confirmed the attacks on October 29, 2026, and told every customer on a vulnerable version to update DSM right away. A security firm that studied the attacks names the ransomware C3RB3R and says it encrypts files with a .L0CK3D extension.

Many small offices, nonprofits and associations use a Synology box as the shared drive and the backup target. That makes it a high-value target: if the NAS is encrypted, the backups on it go too. This post covers what Synology and the researchers say about the Synology ransomware, which DSM builds you need, and the settings that protect your data. Facts are as of November 10, 2026.

The short version: update DSM to the newest build for your branch today, and at least to the builds in Synology’s November 10 advisory. Turn off QuickConnect and router port forwarding unless you truly need remote access, and use a VPN if you do. Turn on two-factor sign-in for every admin account and disable the default admin account. Then schedule immutable snapshots and keep one backup copy off the NAS.

What Synology says about the Synology ransomware attacks

Synology’s October 29 statement says attackers are targeting NAS devices on outdated DSM versions. It says the attacks aim to encrypt data and extort a ransom. Synology says the vulnerability was "patched in December 2024" and points to its advisory Synology-SA-24:20.

The statement does not list fixed build numbers. Its two instructions are short. Synology "strongly urges all users running vulnerable versions to update DSM immediately," and it recommends turning on automatic updates.

The advisory it links, Synology-SA-24:20, was first published on November 5, 2024. Its main flaw, CVE-2024-10441, has a CVSS score of 9.8. According to the advisory, it lets a remote attacker run code on the NAS. Synology added the DSM 6.2 fix to the advisory on December 5, 2024, which likely explains the "December 2024" date in the statement.

What researchers found in the Synology ransomware

The ransomware name comes from Qihoo 360, a Chinese security vendor. In an early warning posted October 29 (in Chinese), 360 says it has received several requests for help from Synology owners since October 2026. It calls the main culprit C3RB3R, a variant of the long-running Cerber ransomware family.

360’s account differs from Synology’s on one point. 360 says this campaign uses two newer DSM flaws, CVE-2026-13639 and CVE-2026-13684. Synology fixed both on September 18, 2026. Synology’s own statement names only the 2024 advisory. We could not confirm which flaw each Synology ransomware infection used, so patch for all of them.

According to 360, C3RB3R:

• Skips 27 system folders so the NAS keeps running, then encrypts files everywhere else.
• Uses ChaCha8 for file contents and RSA-2048 to protect the keys.
• Adds the .L0CK3D extension to encrypted files.
• Leaves a ransom note named read-me3.txt in each folder it encrypts.

The Hacker News reported the campaign on November 3 and linked Reddit threads from owners who say they were hit.

Which DSM builds fix the Synology ransomware flaws

Three Synology advisories matter here. The table below lists the fixed builds for each DSM branch. Your NAS needs to be at or above every build in its row.

Synology-SA-26:13 is rated Critical. CVE-2026-13684 and CVE-2026-13639 each score 9.8. Synology says they let a remote attacker with no account read or write any file and crash services.

Synology-SA-26:19 came out on November 10, 2026, also rated Critical. It fixes CVE-2026-76954, a 9.8 flaw in DSM’s Auth API, and CVE-2026-85101, an 8.6 flaw in rsync. Synology does not say either one is being exploited. Since you are updating anyway, go straight to these builds.

If your NAS runs DSM 7.2, 7.1 or 6.2, neither 2026 advisory lists a fix for your branch. Synology’s guide to updating from an older DSM version says to check the latest version your model supports in the Download Center. Updates must be installed one at a time, in order, and the NAS reboots after each one. If your model cannot move to a fixed branch, plan its replacement.

How to check your DSM version and update

Sign in to DSM as an administrator and open Control Panel > Update & Restore. Synology’s guide says a notification appears there when a newer version is available. Click Download to start.

Compare the full version string with the table, including the last number. A NAS on 7.2.2-72806-8 is still missing the September fixes.

Each update reboots the NAS, so tell staff first and run updates outside working hours if you can.

After you are current, turn on automatic updates, as Synology recommends. Staying current is the main defense against Synology ransomware.

Close the internet path the Synology ransomware needs

Synology’s own ransomware prevention guide starts with internet exposure. It says plainly: "Do not expose DSM to the Internet unless necessary." If staff need files from outside the office, it recommends a VPN. Our explainer on what a VPN is covers the basics.

There are two common ways a NAS ends up on the internet. Check both.

QuickConnect. Synology’s QuickConnect help says it lets apps reach your NAS over the internet "without the hassle of setting up port forwarding rules." It is set at Control Panel > External Access > QuickConnect. If no one needs remote access, clear Enable QuickConnect. If some apps need it, the Advanced Settings page lets you turn QuickConnect off for specific apps and services.

Port forwarding on the router. DSM uses ports 5000 (HTTP) and 5001 (HTTPS) by default. Log in to your router or firewall and remove any rules that forward those ports to the NAS. Also check Control Panel > External Access > Router Configuration, where DSM can set up forwarding for you.

Synology’s NAS security guide also covers the DSM firewall. At Control Panel > Security > Firewall, create allow rules for trusted addresses, then deny everything else. The guide warns you to sign in by IP address, not QuickConnect, while you build the rules. Otherwise you can lock yourself out.

Lock down admin accounts

The same guide lists account settings that make stolen or guessed passwords less useful:

• Disable the default admin account. First confirm another administrator account can sign in.
• Turn on two-factor authentication. In DSM 7, each user sets it at Options > Personal > Security > 2-Factor Authentication. Our post on multi-factor authentication explains the options.
• Turn on Auto Block. At Control Panel > Security > Protection, DSM blocks an address after a set number of failed sign-ins.
• Turn on Account Protection at Control Panel > Security > Account to slow brute-force attempts.
• Run Security Advisor, the built-in app that scans DSM settings and flags weak spots.

Two-factor sign-in does not stop an attacker who uses a flaw that needs no account. 360 says the Synology ransomware uses such flaws, so updating comes first.

Turn on immutable snapshots and keep a backup off the NAS

Synology ransomware is a backup problem as much as a patching problem. Synology’s Snapshot Replication package can take scheduled snapshots of shared folders. Its snapshot help page describes an option called Enable immutable snapshots. Synology says that during the protection period the snapshot "cannot be removed by any means." It recommends a protection period of 7 to 14 days.

To set it up, open Snapshot Replication, select a shared folder, and go to Settings > Schedule. Select Enable snapshot schedule, set the interval, and select Enable immutable snapshots. Then set a retention policy so older snapshots clear out.

Know the limits before you count on it:

• Shared folder snapshots need a Btrfs volume. An ext4 volume cannot take them.
• Synology says immutable snapshots are only available on specific models.
• A shared folder with immutable snapshots cannot be deleted until the protection period ends.
• Snapshots live on the same hardware. A dead disk set or a stolen box takes them too.

That last point is why Synology also tells customers to keep "an offline, encrypted backup" and to follow the 3-2-1 rule. Its guide points to Hyper Backup for copies to another NAS or the cloud. Our data backup strategy guide walks through 3-2-1 in plain terms. Test a restore at least once.

If Synology ransomware already encrypted your NAS

Synology’s ransomware guide lists the first steps. Find which systems are affected and isolate them from the network. If you cannot disconnect a device, power it down. Synology notes that a shutdown loses evidence held in memory, so disconnecting is better when you can.

Then restore from snapshots or backups, starting with the most important shares. Synology suggests reinstalling DSM once you confirm the system is clean, and resetting account passwords after that. Synology Support asks for system logs from Support Center.

360 urges victims not to pay. Our primer on understanding ransomware covers why paying rarely ends the problem. If the NAS held donor, member or client data, start your data breach response plan as well.

Why NAS boxes keep getting hit

This is the same pattern we saw with the GlobalProtect ransomware story: a device that sits at the edge of the network, a fix that already exists, and owners who have not installed it. A NAS often sits in a closet for years, and no one owns its updates.

For agencies and MSPs, find every Synology box you look after, note its model and DSM build, and update the ones that are behind. Then ask each client whether anyone uses QuickConnect from outside the office. A short list of boxes and builds makes the next round of Synology ransomware warnings easy to act on.

Frequently Asked Questions