Responder reports through October 29, 2026; Synology advisory Synology-SA-26:13 published September 18, 2026
C3RB3R Ransomware Is Encrypting Synology NAS Devices That Missed a September Patch
Responders handling Synology network attached storage cases since early October attribute a wave of encryptions to C3RB3R, a variant of the long-running Cerber ransomware family. Encrypted files, including photos, documents, code repositories, and backup files, gain the extension .L0CK3D, and each affected folder receives a ransom note named read-me3.txt directing victims to a Tor site. The reported entry route is two DiskStation Manager flaws, CVE-2026-13639 and CVE-2026-13684, each rated 9.8, which Synology disclosed on September 18 in advisory Synology-SA-26:13; an unauthenticated remote attacker can use them to read or write arbitrary files and to disrupt service, Synology lists no workaround, and the advisory covers eight flaws in total. Fixed releases are DSM 7.4-90075, 7.3.2-86009-4, 7.2.2-72806-9, and 7.2.1-69057-12, or later in each branch, which makes this a classic one-day pattern: exploitation of a recently patched flaw on devices that had not yet updated, roughly six weeks after the fix. The entry point is not fully confirmed in every case. One incident response team reports a victim already running a recent DSM 7.4.1 build and says it cannot yet rule out a new flaw, or abuse of packages, containers, or credentials; some users suspect a GitLab instance running in a container. No free public decryption tool for C3RB3R has been confirmed, so recovery depends on clean backups or snapshots the attackers could not reach.
Executives
A storage device that also holds the backups is a single point of failure, and this campaign is encrypting both together. The decision to fund is not exotic: one offline or otherwise isolated copy of important data, tested restores, and automatic updates turned on for the devices that hold it. If a Synology unit supports a team or a small business you own, its DSM version is a number worth knowing this week.
CIO / CISO
Confirm every Synology unit, including the forgotten ones at branch sites and in labs, runs a fixed DSM release or later for its branch, and record the exceptions with dates. Then close the second door the reporting points to: packages, containers, and shared services exposed to the internet are part of the same attack surface, and at least one case under investigation was current on DSM, so patch level alone should not close the review.
Engineers
Update DSM through Control Panel, Update and Restore, enable automatic DSM and package updates, and remove packages and services you no longer use. Do not forward NAS management ports from the router; use a VPN or the vendor relay for remote access, enable the firewall with trusted addresses only, disable the default admin account, and turn on two-step verification and automatic IP blocking. Enable shared folder snapshots with tamper protection, check Log Center for unusual logins or mass file changes, and keep one backup copy offline. If a device is already hit, disconnect it from the network, keep the ransom note, logs, and sample files, and do not reinstall before recovery options are assessed.
Everyone (non-IT)
If you keep family photos or work files on a home NAS, update it today and make one copy somewhere the NAS cannot reach, such as a drive you unplug afterward. Ransomware that encrypts the only copy and the backup on the same box leaves nothing to restore from, and reporting the incident to the FBI Internet Crime Complaint Center at ic3.gov helps track the campaign.