{"id":"CMP-202610-c3rb3r-cerber-ransomware-is-encrypting-internet-exposed-syno","kind":"campaign","aliases":[],"related":["CVE-2026-13639","CVE-2026-13684"],"title":"C3RB3R (Cerber) ransomware is encrypting internet-exposed Synology NAS devices and their backups; Synology confirms attacks on outdated DSM","description":null,"summary":"Since early October 2026, 360's anti-ransomware team and other responders report a wave of C3RB3R (a Cerber variant) attacks that encrypt files on Synology NAS devices, including backups stored there. No user interaction is needed. Exposed NAS units on outdated DiskStation Manager (DSM) are at risk. On Oct 29 Synology confirmed attackers are exploiting a flaw patched in December 2024 (Synology-SA-24:20). 360 instead names CVE-2026-13639 and CVE-2026-13684 (CVSS 9.8, unauthenticated file read/write; Synology-SA-26:13, Sept 18 2026). So the exact entry point is disputed. One IR team saw a victim already on a recent DSM 7.4.1 build and cannot rule out a new flaw, or abuse of packages, containers (a GitLab container is suspected) or credentials. Some reports also tie it to the PHP2Shell flaws in PHP-based packages. Social posts call it a 0-day, but that is unconfirmed. Macau's PJ and RSM Hong Kong have issued alerts. No free decryptor is known.","severity":"critical","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-10-30T18:37:03+00:00","products":[{"name":"Synology DSM","fixed":["7.4-90075","7.3.2-86009-4","7.2.2-72806-9","7.2.1-69057-12"],"vendor":"Synology","affected":"outdated DSM; < 7.4-90075, < 7.3.2-86009-4, < 7.2.2-72806-9, < 7.2.1-69057-12 (one case on 7.4.1 unexplained)"},{"name":"Synology NAS","fixed":[],"vendor":"Synology"}],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"Look for files renamed with the .L0CK3D extension and a ransom note named read-me3.txt in each folder (it points to a Tor site). In Log Center, check for unusual logins or mass file changes. List every Synology unit with its DSM version and check whether DSM management, packages or containers are reachable from the internet.","fix":"Update DSM now to a fixed release or later for your branch: 7.4-90075, 7.3.2-86009-4, 7.2.2-72806-9 or 7.2.1-69057-12. Also apply the SA-24:20 and PHP2Shell package fixes, and turn on automatic DSM and package updates. Stop forwarding NAS management ports and use a VPN instead. Remove unused packages, containers and services. Enable the firewall with trusted IPs only, disable the default admin account, and enforce 2FA. Enable immutable/tamper-protected snapshots and keep one offline backup. If a device is hit, unplug it from the network, keep the note, logs and samples, and do not pay.","status":"open","published_at":"2026-10-29T00:00:00+00:00","first_seen_at":"2026-10-30T18:37:03+00:00","triaged_at":"2026-10-30T18:37:03+00:00","updated_at":"2026-10-30T18:37:03+00:00","category":"vendor","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-13639':115B '-13684':119B '-2026':114B,118B '-202610':22A '0':191B '13':129B '18':131B '20':109B '2024':104B '2026':45B,132B '24':108B '26':128B '29':93B '360':46B,110B '7.4.1':151B '9.8':121B 'abus':161B 'alert':206B 'alreadi':146B 'also':174B 'anti':49B 'anti-ransomwar':48B 'attack':17A,63B,96B 'backup':14A,72B 'base':184B 'build':152B 'c3rb3r':1A,24A,32A,59B 'c3rb3r-cerber-ransomware-is-encrypting-internet-exposed-syno':23A 'call':188B 'campaign':38B 'cannot':154B 'cerber':2A,25A,33A,61B 'cmp':21A 'confirm':16A,95B 'contain':164B,167B 'credenti':171B 'cve':113B,117B 'cvss':120B 'day':192B 'decemb':103B 'decryptor':209B 'devic':11A,70B 'diskstat':85B 'disput':139B 'dsm':20A,35A,87B,150B 'earli':40B,43B 'early-warn':39B 'encrypt':5A,65B 'encrypting':28A 'entri':136B 'exact':135B 'exploit':98B 'expos':8A,80B 'exposed':30A 'file':66B,123B 'flaw':100B,159B,180B 'free':208B 'gitlab':166B 'hong':202B 'includ':71B 'instead':111B 'interact':77B 'internet':7A,29A 'internet-expos':6A 'ir':141B 'is':27A 'issu':205B 'known':211B 'kong':203B 'macau':197B 'manag':86B 'name':112B 'nas':10A,37A,69B,81B 'need':79B 'new':158B 'oct':92B 'octob':44B 'one':140B 'outdat':19A,84B 'packag':163B,185B 'patch':101B 'php':183B 'php-base':182B 'php2shell':179B 'pj':199B 'point':137B 'post':187B 'ransomwar':3A,50B 'ransomware':26A 'read/write':124B 'recent':149B 'report':55B,173B 'respond':54B 'risk':90B 'rsm':201B 'rule':155B 'sa':107B,127B 'saw':143B 'sept':130B 'sinc':42B 'social':186B 'store':73B 'suspect':169B 'syno':31A 'synolog':9A,15A,68B,94B,106B,126B 'synology':34A,36A 'synology-sa':105B,125B 'team':51B,142B 'tie':175B 'unauthent':122B 'unconfirm':196B 'unit':82B 'user':76B 'variant':62B 'victim':145B 'warn':41B 'wave':57B","nicknames":["C3RB3R","Cerber"],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"first_public_at":"2026-10-29T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202610-c3rb3r-cerber-ransomware-is-encrypting-internet-exposed-syno","url":null,"severity":null,"published_at":"2026-10-29T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-30T18:37:03+00:00","fetched_at":"2026-10-30T18:37:03+00:00","note":null}],"documents":[{"id":25158,"url":"https://x.com/dinodaizovi/status/2116229881197432993","title":"@dinodaizovi: \"Waking up from a nap, thousands of Synology NAS devices have already been hit b","kind":"post","source":"x","publisher":null,"text":"\"Waking up from a nap, thousands of Synology NAS devices have already been hit by a 0-day ransomware attack, with all file data suffering losses.\" https://t.co/ftv3oDG0dd\n\nlikes 2 reposts 0","published_at":"2026-10-30T18:04:55+00:00","relation":"describes","confidence":null,"note":null},{"id":25196,"url":"https://www.synology.com/en-global/company/news/article/C3RB3R","title":"Synology urges users to update DSM following ransomware attacks on outdated DSM versions","kind":"vendor","source":"analyst","publisher":null,"text":"Synology, Oct 29 2026: threat actors exploiting a vulnerability patched in December 2024 to target devices running outdated DSM versions, encrypting data and extorting ransom. Update DSM immediately, enable automatic updates. See Synology-SA-24:20.","published_at":"2026-10-29T00:00:00+00:00","relation":"describes","confidence":null,"note":null},{"id":25197,"url":"https://www.trebsec.com/briefs/2026-10-29-synology-c3rb3r-ransomware.html","title":"C3RB3R Ransomware Is Encrypting Synology NAS Devices That Missed a September Patch (TrebSec)","kind":"blog","source":"analyst","publisher":null,"text":"Responders since early October attribute Synology NAS encryptions to C3RB3R (Cerber variant). Files get .L0CK3D extension, ransom note read-me3.txt in each folder, Tor site. Reported entry: DSM CVE-2026-13639 and CVE-2026-13684 (CVSS 9.8, unauthenticated arbitrary file read/write), Synology-SA-26:13 of Sept 18; fixed in DSM 7.4-90075, 7.3.2-86009-4, 7.2.2-72806-9, 7.2.1-69057-12. Entry not confirmed in every case: one IR team saw a victim on recent DSM 7.4.1 and cannot rule out a new flaw, or abuse of packages, containers (suspected GitLab container) or credentials. No free decryptor confirmed. 360 anti-ransomware team is the original source; Synology itself points to SA-24:20 (Dec 2024 patch).","published_at":"2026-10-29T00:00:00+00:00","relation":"describes","confidence":null,"note":null},{"id":25159,"url":"https://x.com/dinodaizovi/status/2116229330611384352","title":"@dinodaizovi: There we go: https://t.co/xiZru3NHo9","kind":"post","source":"x","publisher":null,"text":"There we go: https://t.co/xiZru3NHo9\n\nlikes 1 reposts 0","published_at":"2026-10-30T18:02:44+00:00","relation":"discussion","confidence":0.6,"note":"Same author's follow-up post ('There we go'), seconds before the Synology ransomware quote"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}