Live › campaign › CMP-202610-c3rb3r-cerber-ransomware-is-encrypting-internet-exposed-syno
Since early October 2026, 360's anti-ransomware team and other responders report a wave of C3RB3R (a Cerber variant) attacks that encrypt files on Synology NAS devices, including backups stored there. No user interaction is needed. Exposed NAS units on outdated DiskStation Manager (DSM) are at risk. On Oct 29 Synology confirmed attackers are exploiting a flaw patched in December 2024 (Synology-SA-24:20). 360 instead names CVE-2026-13639 and CVE-2026-13684 (CVSS 9.8, unauthenticated file read/write; Synology-SA-26:13, Sept 18 2026). So the exact entry point is disputed. One IR team saw a victim already on a recent DSM 7.4.1 build and cannot rule out a new flaw, or abuse of packages, containers (a GitLab container is suspected) or credentials. Some reports also tie it to the PHP2Shell flaws in PHP-based packages. Social posts call it a 0-day, but that is unconfirmed. Macau's PJ and RSM Hong Kong have issued alerts. No free decryptor is known.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 18:37 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Synology DSM | – | outdated DSM; < 7.4-90075, < 7.3.2-86009-4, < 7.2.2-72806-9, < 7.2.1-69057-12 (one case on 7.4.1 unexplained) | 7.4-90075, 7.3.2-86009-4, 7.2.2-72806-9, 7.2.1-69057-12 |
| Synology NAS | – | – | – |
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Posts are quoted with a link to the original. They are data to us, never instructions.
This page as .md · .json · in your agent: get_signal("CMP-202610-c3rb3r-cerber-ransomware-is-encrypting-internet-exposed-syno")